Analysis Report Quotation-4834898943949883.pdf.exe

Overview

General Information

Sample Name: Quotation-4834898943949883.pdf.exe
Analysis ID: 383906
MD5: 57055ad7429ef21caca78a9428e8a332
SHA1: 4df1aae070d95c2fd6c40ba3070a2af53462f3e6
SHA256: f15085a9037c117355a6b500780d5df0530a6c6724e4506622565b4c13582876
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: www.mcgeefamilychildcare.com/nc6m/ Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.mcgeefamilychildcare.com/nc6m/"], "decoy": ["saltypar.com", "most.community", "johnmucollection.com", "houzzthings.net", "onemarketips.com", "legalmarketingtx.net", "criminalmindeddesign.com", "dtrinvesting.com", "millertaxpreparation.com", "wckfwwehmo.net", "begoodmeat.com", "tradefinance.fyi", "taxbizfunnels.com", "learnstartupdesign.com", "hxmdelights.com", "christiandantrust.faith", "dimensionshypnosis.com", "261391.com", "cancellednot.com", "paodanmeng.com", "thewayoutbooks.com", "halsdraincleaning.com", "jumlasx.xyz", "sutransformacion.com", "abisagne.com", "yingjiebj.com", "prodgra.com", "phone-review24.club", "weandvirus.com", "thelibertyhomeinspector.com", "fuckblarkie.com", "tappesupportservices.com", "marianiemorazzani.com", "skyybluchildkare.info", "diysecurityreview.com", "insuranceagentwilliams.com", "k-yahagigumi.com", "b3ourg.xyz", "mawhl.net", "billionartoffaith.com", "tech4thelolo.com", "vlvglobal.com", "positive-agenda-advisory.com", "sdzcsyy.com", "jxdiil.com", "craicing.com", "opinionesymodelos.com", "tulsaprintingcompany.com", "papaifotografo.com", "kalpavasi.com", "century21comingsoon.com", "bahiaprincipegrand.com", "tinwinsolar.ltd", "emprenviendo.com", "nineykal.com", "tam-rh.cat", "onlyfanscash.com", "florida-sunny.com", "workmone.online", "sastaafoods.com", "financiallyhealthy.life", "unudix.com", "wwwsumwater.com", "iparametricjobs.com"]}
Multi AV Scanner detection for submitted file
Source: Quotation-4834898943949883.pdf.exe Virustotal: Detection: 26% Perma Link
Source: Quotation-4834898943949883.pdf.exe ReversingLabs: Detection: 22%
Yara detected FormBook
Source: Yara match File source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: Quotation-4834898943949883.pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Quotation-4834898943949883.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Quotation-4834898943949883.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241176585.0000000001430000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 1_2_04D71B98
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 1_2_04D71BA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 1_2_0771FBA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then pop ebx 4_2_00407AFB

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.mcgeefamilychildcare.com/nc6m/
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000001.00000002.240654193.0000000002CE1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: Quotation-4834898943949883.pdf.exe String found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
Source: Quotation-4834898943949883.pdf.exe String found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Quotation-4834898943949883.pdf.exe
Source: initial sample Static PE information: Filename: Quotation-4834898943949883.pdf.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07716878 NtQueryInformationProcess, 1_2_07716878
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07716873 NtQueryInformationProcess, 1_2_07716873
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A060 NtClose, 4_2_0041A060
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A110 NtAllocateVirtualMemory, 4_2_0041A110
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419F30 NtCreateFile, 4_2_00419F30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419FE0 NtReadFile, 4_2_00419FE0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419F2A NtCreateFile, 4_2_00419F2A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419F82 NtCreateFile, 4_2_00419F82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_01499860
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499660 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_01499660
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014996E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_014996E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499950 NtQueueApcThread, 4_2_01499950
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499910 NtAdjustPrivilegesToken, 4_2_01499910
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014999D0 NtCreateProcessEx, 4_2_014999D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014999A0 NtCreateSection, 4_2_014999A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0149B040 NtSuspendThread, 4_2_0149B040
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499840 NtDelayExecution, 4_2_01499840
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499820 NtEnumerateKey, 4_2_01499820
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014998F0 NtReadVirtualMemory, 4_2_014998F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014998A0 NtWriteVirtualMemory, 4_2_014998A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499B00 NtSetValueKey, 4_2_01499B00
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0149A3B0 NtGetContextThread, 4_2_0149A3B0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499A50 NtCreateFile, 4_2_01499A50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499A00 NtProtectVirtualMemory, 4_2_01499A00
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499A10 NtQuerySection, 4_2_01499A10
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499A20 NtResumeThread, 4_2_01499A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499A80 NtOpenDirectoryObject, 4_2_01499A80
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499540 NtReadFile, 4_2_01499540
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499560 NtWriteFile, 4_2_01499560
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499520 NtWaitForSingleObject, 4_2_01499520
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0149AD30 NtSetContextThread, 4_2_0149AD30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014995D0 NtClose, 4_2_014995D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014995F0 NtQueryInformationFile, 4_2_014995F0
Detected potential crypto function
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0094DCE7 1_2_0094DCE7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0094A9EA 1_2_0094A9EA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_011BC2B0 1_2_011BC2B0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_011B9990 1_2_011B9990
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_04D70448 1_2_04D70448
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_04D71770 1_2_04D71770
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07715520 1_2_07715520
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07710740 1_2_07710740
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711FA8 1_2_07711FA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711F99 1_2_07711F99
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711D60 1_2_07711D60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711D51 1_2_07711D51
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0771A550 1_2_0771A550
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07712D40 1_2_07712D40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0771A53F 1_2_0771A53F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07715510 1_2_07715510
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_077114E0 1_2_077114E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_077114D1 1_2_077114D1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711B58 1_2_07711B58
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07711B48 1_2_07711B48
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07718BB0 1_2_07718BB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07718BA3 1_2_07718BA3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07716A10 1_2_07716A10
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07712170 1_2_07712170
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07719170 1_2_07719170
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07712163 1_2_07712163
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07710938 1_2_07710938
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07710929 1_2_07710929
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07719180 1_2_07719180
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0094AAC7 1_2_0094AAC7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00401209 4_2_00401209
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041DAFA 4_2_0041DAFA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D378 4_2_0041D378
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409DFC 4_2_00409DFC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00402D88 4_2_00402D88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409E40 4_2_00409E40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D631 4_2_0041D631
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00402FB0 4_2_00402FB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0097A9EA 4_2_0097A9EA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0097DCE7 4_2_0097DCE7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145F900 4_2_0145F900
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01472990 4_2_01472990
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01456800 4_2_01456800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511002 4_2_01511002
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152E824 4_2_0152E824
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A830 4_2_0147A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015228EC 4_2_015228EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B090 4_2_0146B090
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015220A8 4_2_015220A8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FCB4F 4_2_014FCB4F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147AB40 4_2_0147AB40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01473360 4_2_01473360
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151231B 4_2_0151231B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01522B28 4_2_01522B28
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151DBD2 4_2_0151DBD2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015103DA 4_2_015103DA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148ABD8 4_2_0148ABD8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014A8BE8 4_2_014A8BE8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015023E3 4_2_015023E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148138B 4_2_0148138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FEB8A 4_2_014FEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147EB9A 4_2_0147EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148EBB0 4_2_0148EBB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0150FA2B 4_2_0150FA2B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151E2C5 4_2_0151E2C5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015232A9 4_2_015232A9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015222AE 4_2_015222AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01521D55 4_2_01521D55
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01472D50 4_2_01472D50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01522D07 4_2_01522D07
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01450D20 4_2_01450D20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015225DD 4_2_015225DD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146D5E0 4_2_0146D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482581 4_2_01482581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014865A0 4_2_014865A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151D466 4_2_0151D466
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146841F 4_2_0146841F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01472430 4_2_01472430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0097AAC7 4_2_0097AAC7
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: String function: 0145B150 appears 121 times
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: String function: 014E5720 appears 62 times
PE file contains strange resources
Source: Quotation-4834898943949883.pdf.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Quotation-4834898943949883.pdf.exe Binary or memory string: OriginalFilename vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245565115.0000000007680000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000000.217395296.0000000000942000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240654193.0000000002CE1000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245113568.0000000006E30000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe Binary or memory string: OriginalFilename vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000004.00000000.238479725.0000000000972000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241413507.000000000154F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe Binary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
Uses 32bit PE files
Source: Quotation-4834898943949883.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Quotation-4834898943949883.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Mutant created: \Sessions\1\BaseNamedObjects\uwviaTyAYnlyFJcXtcTQZZrdZh
Source: Quotation-4834898943949883.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Quotation-4834898943949883.pdf.exe Virustotal: Detection: 26%
Source: Quotation-4834898943949883.pdf.exe ReversingLabs: Detection: 22%
Source: unknown Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe 'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Quotation-4834898943949883.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Quotation-4834898943949883.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241176585.0000000001430000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0094D65F push es; retn 0001h 1_2_0094D6BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_0094DC4E push 00000000h; iretd 1_2_0094DC98
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 1_2_07716E6F pushfd ; retf 1_2_07716E78
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D0D2 push eax; ret 4_2_0041D0D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D0DB push eax; ret 4_2_0041D142
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D085 push eax; ret 4_2_0041D0D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D13C push eax; ret 4_2_0041D142
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0040B3F8 push ebx; iretd 4_2_0040B3FB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041766B push eax; ret 4_2_0041766E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0040DF92 push ebp; retf 4_2_0040DF93
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041AFBA pushad ; retf 4_2_0041AFBE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0097DC4E push 00000000h; iretd 4_2_0097DC98
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0097D65F push es; retn 0001h 4_2_0097D6BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014AD0D1 push ecx; ret 4_2_014AD0E4
Source: initial sample Static PE information: section name: .text entropy: 7.61748315782

Hooking and other Techniques for Hiding and Protection:

barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Quotation-4834898943949883.pdf.exe
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quotation-4834898943949883.pdf.exe PID: 5956, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 5952 Thread sleep time: -100018s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 6028 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 100018 Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01499860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_01499860
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511951 mov eax, dword ptr fs:[00000030h] 4_2_01511951
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B944 mov eax, dword ptr fs:[00000030h] 4_2_0147B944
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B944 mov eax, dword ptr fs:[00000030h] 4_2_0147B944
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145395E mov eax, dword ptr fs:[00000030h] 4_2_0145395E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145395E mov eax, dword ptr fs:[00000030h] 4_2_0145395E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145C962 mov eax, dword ptr fs:[00000030h] 4_2_0145C962
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151E962 mov eax, dword ptr fs:[00000030h] 4_2_0151E962
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145B171 mov eax, dword ptr fs:[00000030h] 4_2_0145B171
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145B171 mov eax, dword ptr fs:[00000030h] 4_2_0145B171
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528966 mov eax, dword ptr fs:[00000030h] 4_2_01528966
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459100 mov eax, dword ptr fs:[00000030h] 4_2_01459100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459100 mov eax, dword ptr fs:[00000030h] 4_2_01459100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459100 mov eax, dword ptr fs:[00000030h] 4_2_01459100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01460100 mov eax, dword ptr fs:[00000030h] 4_2_01460100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01460100 mov eax, dword ptr fs:[00000030h] 4_2_01460100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01460100 mov eax, dword ptr fs:[00000030h] 4_2_01460100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 mov eax, dword ptr fs:[00000030h] 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 mov eax, dword ptr fs:[00000030h] 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 mov eax, dword ptr fs:[00000030h] 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 mov eax, dword ptr fs:[00000030h] 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01474120 mov ecx, dword ptr fs:[00000030h] 4_2_01474120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148513A mov eax, dword ptr fs:[00000030h] 4_2_0148513A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148513A mov eax, dword ptr fs:[00000030h] 4_2_0148513A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01453138 mov ecx, dword ptr fs:[00000030h] 4_2_01453138
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h] 4_2_014699C7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h] 4_2_014699C7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h] 4_2_014699C7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h] 4_2_014699C7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015119D8 mov eax, dword ptr fs:[00000030h] 4_2_015119D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0145B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0145B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0145B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014531E0 mov eax, dword ptr fs:[00000030h] 4_2_014531E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014E41E8 mov eax, dword ptr fs:[00000030h] 4_2_014E41E8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015289E7 mov eax, dword ptr fs:[00000030h] 4_2_015289E7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147C182 mov eax, dword ptr fs:[00000030h] 4_2_0147C182
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148A185 mov eax, dword ptr fs:[00000030h] 4_2_0148A185
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482990 mov eax, dword ptr fs:[00000030h] 4_2_01482990
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484190 mov eax, dword ptr fs:[00000030h] 4_2_01484190
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151A189 mov eax, dword ptr fs:[00000030h] 4_2_0151A189
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151A189 mov ecx, dword ptr fs:[00000030h] 4_2_0151A189
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145519E mov eax, dword ptr fs:[00000030h] 4_2_0145519E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145519E mov ecx, dword ptr fs:[00000030h] 4_2_0145519E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0152F1B5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0152F1B5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014861A0 mov eax, dword ptr fs:[00000030h] 4_2_014861A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014861A0 mov eax, dword ptr fs:[00000030h] 4_2_014861A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D69A6 mov eax, dword ptr fs:[00000030h] 4_2_014D69A6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h] 4_2_014D51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h] 4_2_014D51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h] 4_2_014D51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h] 4_2_014D51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h] 4_2_015149A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h] 4_2_015149A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h] 4_2_015149A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h] 4_2_015149A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148C9BF mov eax, dword ptr fs:[00000030h] 4_2_0148C9BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148C9BF mov eax, dword ptr fs:[00000030h] 4_2_0148C9BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov eax, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov eax, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov eax, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014799BF mov eax, dword ptr fs:[00000030h] 4_2_014799BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511843 mov eax, dword ptr fs:[00000030h] 4_2_01511843
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01457057 mov eax, dword ptr fs:[00000030h] 4_2_01457057
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455050 mov eax, dword ptr fs:[00000030h] 4_2_01455050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455050 mov eax, dword ptr fs:[00000030h] 4_2_01455050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455050 mov eax, dword ptr fs:[00000030h] 4_2_01455050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01470050 mov eax, dword ptr fs:[00000030h] 4_2_01470050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01470050 mov eax, dword ptr fs:[00000030h] 4_2_01470050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512073 mov eax, dword ptr fs:[00000030h] 4_2_01512073
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01521074 mov eax, dword ptr fs:[00000030h] 4_2_01521074
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147F86D mov eax, dword ptr fs:[00000030h] 4_2_0147F86D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01456800 mov eax, dword ptr fs:[00000030h] 4_2_01456800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01456800 mov eax, dword ptr fs:[00000030h] 4_2_01456800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01456800 mov eax, dword ptr fs:[00000030h] 4_2_01456800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01524015 mov eax, dword ptr fs:[00000030h] 4_2_01524015
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01524015 mov eax, dword ptr fs:[00000030h] 4_2_01524015
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h] 4_2_014D7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h] 4_2_014D7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h] 4_2_014D7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148002D mov eax, dword ptr fs:[00000030h] 4_2_0148002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148002D mov eax, dword ptr fs:[00000030h] 4_2_0148002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148002D mov eax, dword ptr fs:[00000030h] 4_2_0148002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148002D mov eax, dword ptr fs:[00000030h] 4_2_0148002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148002D mov eax, dword ptr fs:[00000030h] 4_2_0148002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484020 mov edi, dword ptr fs:[00000030h] 4_2_01484020
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h] 4_2_0146B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h] 4_2_0146B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h] 4_2_0146B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h] 4_2_0146B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h] 4_2_0147A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h] 4_2_0147A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h] 4_2_0147A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h] 4_2_0147A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014570C0 mov eax, dword ptr fs:[00000030h] 4_2_014570C0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014570C0 mov eax, dword ptr fs:[00000030h] 4_2_014570C0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015118CA mov eax, dword ptr fs:[00000030h] 4_2_015118CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov ecx, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h] 4_2_014EB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B8E4 mov eax, dword ptr fs:[00000030h] 4_2_0147B8E4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B8E4 mov eax, dword ptr fs:[00000030h] 4_2_0147B8E4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h] 4_2_014540E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h] 4_2_014540E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h] 4_2_014540E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014558EC mov eax, dword ptr fs:[00000030h] 4_2_014558EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628FD mov eax, dword ptr fs:[00000030h] 4_2_014628FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628FD mov eax, dword ptr fs:[00000030h] 4_2_014628FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628FD mov eax, dword ptr fs:[00000030h] 4_2_014628FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459080 mov eax, dword ptr fs:[00000030h] 4_2_01459080
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01453880 mov eax, dword ptr fs:[00000030h] 4_2_01453880
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01453880 mov eax, dword ptr fs:[00000030h] 4_2_01453880
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D3884 mov eax, dword ptr fs:[00000030h] 4_2_014D3884
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D3884 mov eax, dword ptr fs:[00000030h] 4_2_014D3884
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014990AF mov eax, dword ptr fs:[00000030h] 4_2_014990AF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h] 4_2_014820A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov eax, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov eax, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov eax, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov ecx, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov eax, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014628AE mov eax, dword ptr fs:[00000030h] 4_2_014628AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F0BF mov ecx, dword ptr fs:[00000030h] 4_2_0148F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F0BF mov eax, dword ptr fs:[00000030h] 4_2_0148F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F0BF mov eax, dword ptr fs:[00000030h] 4_2_0148F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145DB40 mov eax, dword ptr fs:[00000030h] 4_2_0145DB40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528B58 mov eax, dword ptr fs:[00000030h] 4_2_01528B58
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h] 4_2_01483B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h] 4_2_01483B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h] 4_2_01483B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h] 4_2_01483B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145F358 mov eax, dword ptr fs:[00000030h] 4_2_0145F358
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145DB60 mov ecx, dword ptr fs:[00000030h] 4_2_0145DB60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h] 4_2_014E6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h] 4_2_014E6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h] 4_2_014E6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B7A mov eax, dword ptr fs:[00000030h] 4_2_01483B7A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483B7A mov eax, dword ptr fs:[00000030h] 4_2_01483B7A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h] 4_2_0146F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h] 4_2_0146F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h] 4_2_0146F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151131B mov eax, dword ptr fs:[00000030h] 4_2_0151131B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h] 4_2_0147A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D53CA mov eax, dword ptr fs:[00000030h] 4_2_014D53CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D53CA mov eax, dword ptr fs:[00000030h] 4_2_014D53CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014853C5 mov eax, dword ptr fs:[00000030h] 4_2_014853C5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h] 4_2_014803E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01451BE9 mov eax, dword ptr fs:[00000030h] 4_2_01451BE9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147DBE9 mov eax, dword ptr fs:[00000030h] 4_2_0147DBE9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015023E3 mov ecx, dword ptr fs:[00000030h] 4_2_015023E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015023E3 mov ecx, dword ptr fs:[00000030h] 4_2_015023E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015023E3 mov eax, dword ptr fs:[00000030h] 4_2_015023E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148138B mov eax, dword ptr fs:[00000030h] 4_2_0148138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148138B mov eax, dword ptr fs:[00000030h] 4_2_0148138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148138B mov eax, dword ptr fs:[00000030h] 4_2_0148138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FEB8A mov ecx, dword ptr fs:[00000030h] 4_2_014FEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h] 4_2_014FEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h] 4_2_014FEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h] 4_2_014FEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01461B8F mov eax, dword ptr fs:[00000030h] 4_2_01461B8F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01461B8F mov eax, dword ptr fs:[00000030h] 4_2_01461B8F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0150D380 mov ecx, dword ptr fs:[00000030h] 4_2_0150D380
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01454B94 mov edi, dword ptr fs:[00000030h] 4_2_01454B94
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148B390 mov eax, dword ptr fs:[00000030h] 4_2_0148B390
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151138A mov eax, dword ptr fs:[00000030h] 4_2_0151138A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147EB9A mov eax, dword ptr fs:[00000030h] 4_2_0147EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147EB9A mov eax, dword ptr fs:[00000030h] 4_2_0147EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482397 mov eax, dword ptr fs:[00000030h] 4_2_01482397
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528BB6 mov eax, dword ptr fs:[00000030h] 4_2_01528BB6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h] 4_2_01484BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h] 4_2_01484BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h] 4_2_01484BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01529BBE mov eax, dword ptr fs:[00000030h] 4_2_01529BBE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01525BA5 mov eax, dword ptr fs:[00000030h] 4_2_01525BA5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511BA8 mov eax, dword ptr fs:[00000030h] 4_2_01511BA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151EA55 mov eax, dword ptr fs:[00000030h] 4_2_0151EA55
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459240 mov eax, dword ptr fs:[00000030h] 4_2_01459240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459240 mov eax, dword ptr fs:[00000030h] 4_2_01459240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459240 mov eax, dword ptr fs:[00000030h] 4_2_01459240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01459240 mov eax, dword ptr fs:[00000030h] 4_2_01459240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511A5F mov eax, dword ptr fs:[00000030h] 4_2_01511A5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014E4257 mov eax, dword ptr fs:[00000030h] 4_2_014E4257
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h] 4_2_01495A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h] 4_2_01495A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h] 4_2_01495A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0150B260 mov eax, dword ptr fs:[00000030h] 4_2_0150B260
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0150B260 mov eax, dword ptr fs:[00000030h] 4_2_0150B260
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528A62 mov eax, dword ptr fs:[00000030h] 4_2_01528A62
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0149927A mov eax, dword ptr fs:[00000030h] 4_2_0149927A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151AA16 mov eax, dword ptr fs:[00000030h] 4_2_0151AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151AA16 mov eax, dword ptr fs:[00000030h] 4_2_0151AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01468A0A mov eax, dword ptr fs:[00000030h] 4_2_01468A0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145AA16 mov eax, dword ptr fs:[00000030h] 4_2_0145AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145AA16 mov eax, dword ptr fs:[00000030h] 4_2_0145AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455210 mov eax, dword ptr fs:[00000030h] 4_2_01455210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455210 mov ecx, dword ptr fs:[00000030h] 4_2_01455210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455210 mov eax, dword ptr fs:[00000030h] 4_2_01455210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455210 mov eax, dword ptr fs:[00000030h] 4_2_01455210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01473A1C mov eax, dword ptr fs:[00000030h] 4_2_01473A1C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01494A2C mov eax, dword ptr fs:[00000030h] 4_2_01494A2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01494A2C mov eax, dword ptr fs:[00000030h] 4_2_01494A2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01454A20 mov eax, dword ptr fs:[00000030h] 4_2_01454A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01454A20 mov eax, dword ptr fs:[00000030h] 4_2_01454A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h] 4_2_0147A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h] 4_2_0147B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511229 mov eax, dword ptr fs:[00000030h] 4_2_01511229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01458239 mov eax, dword ptr fs:[00000030h] 4_2_01458239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01458239 mov eax, dword ptr fs:[00000030h] 4_2_01458239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01458239 mov eax, dword ptr fs:[00000030h] 4_2_01458239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482ACB mov eax, dword ptr fs:[00000030h] 4_2_01482ACB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h] 4_2_01455AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h] 4_2_01455AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h] 4_2_01455AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01453ACA mov eax, dword ptr fs:[00000030h] 4_2_01453ACA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528ADD mov eax, dword ptr fs:[00000030h] 4_2_01528ADD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014512D4 mov eax, dword ptr fs:[00000030h] 4_2_014512D4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482AE4 mov eax, dword ptr fs:[00000030h] 4_2_01482AE4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h] 4_2_01514AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148DA88 mov eax, dword ptr fs:[00000030h] 4_2_0148DA88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148DA88 mov eax, dword ptr fs:[00000030h] 4_2_0148DA88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151129A mov eax, dword ptr fs:[00000030h] 4_2_0151129A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148D294 mov eax, dword ptr fs:[00000030h] 4_2_0148D294
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148D294 mov eax, dword ptr fs:[00000030h] 4_2_0148D294
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h] 4_2_014552A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h] 4_2_014552A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h] 4_2_014552A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h] 4_2_014552A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h] 4_2_014552A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01451AA0 mov eax, dword ptr fs:[00000030h] 4_2_01451AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01485AA0 mov eax, dword ptr fs:[00000030h] 4_2_01485AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01485AA0 mov eax, dword ptr fs:[00000030h] 4_2_01485AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014812BD mov esi, dword ptr fs:[00000030h] 4_2_014812BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014812BD mov eax, dword ptr fs:[00000030h] 4_2_014812BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014812BD mov eax, dword ptr fs:[00000030h] 4_2_014812BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0146AAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0146AAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148FAB0 mov eax, dword ptr fs:[00000030h] 4_2_0148FAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145354C mov eax, dword ptr fs:[00000030h] 4_2_0145354C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145354C mov eax, dword ptr fs:[00000030h] 4_2_0145354C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01493D43 mov eax, dword ptr fs:[00000030h] 4_2_01493D43
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D3540 mov eax, dword ptr fs:[00000030h] 4_2_014D3540
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01503D40 mov eax, dword ptr fs:[00000030h] 4_2_01503D40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01477D50 mov eax, dword ptr fs:[00000030h] 4_2_01477D50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01508D47 mov eax, dword ptr fs:[00000030h] 4_2_01508D47
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01494D51 mov eax, dword ptr fs:[00000030h] 4_2_01494D51
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01494D51 mov eax, dword ptr fs:[00000030h] 4_2_01494D51
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147C577 mov eax, dword ptr fs:[00000030h] 4_2_0147C577
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147C577 mov eax, dword ptr fs:[00000030h] 4_2_0147C577
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h] 4_2_01478D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h] 4_2_01478D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h] 4_2_01478D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h] 4_2_01478D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h] 4_2_01478D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01513518 mov eax, dword ptr fs:[00000030h] 4_2_01513518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01513518 mov eax, dword ptr fs:[00000030h] 4_2_01513518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01513518 mov eax, dword ptr fs:[00000030h] 4_2_01513518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528D34 mov eax, dword ptr fs:[00000030h] 4_2_01528D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151E539 mov eax, dword ptr fs:[00000030h] 4_2_0151E539
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h] 4_2_0148F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h] 4_2_0148F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h] 4_2_0148F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h] 4_2_01463D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h] 4_2_01484D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h] 4_2_01484D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h] 4_2_01484D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0145AD30 mov eax, dword ptr fs:[00000030h] 4_2_0145AD30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014DA537 mov eax, dword ptr fs:[00000030h] 4_2_014DA537
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0150FDD3 mov eax, dword ptr fs:[00000030h] 4_2_0150FDD3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov ecx, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h] 4_2_014D6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014515C1 mov eax, dword ptr fs:[00000030h] 4_2_014515C1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01508DF1 mov eax, dword ptr fs:[00000030h] 4_2_01508DF1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014895EC mov eax, dword ptr fs:[00000030h] 4_2_014895EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0146D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0146D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0151FDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0151FDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0151FDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0151FDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014595F0 mov eax, dword ptr fs:[00000030h] 4_2_014595F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014595F0 mov ecx, dword ptr fs:[00000030h] 4_2_014595F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482581 mov eax, dword ptr fs:[00000030h] 4_2_01482581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482581 mov eax, dword ptr fs:[00000030h] 4_2_01482581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482581 mov eax, dword ptr fs:[00000030h] 4_2_01482581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01482581 mov eax, dword ptr fs:[00000030h] 4_2_01482581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h] 4_2_01452D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h] 4_2_01452D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h] 4_2_01452D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h] 4_2_01452D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h] 4_2_01452D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h] 4_2_0151B581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h] 4_2_0151B581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h] 4_2_0151B581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h] 4_2_0151B581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148FD9B mov eax, dword ptr fs:[00000030h] 4_2_0148FD9B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148FD9B mov eax, dword ptr fs:[00000030h] 4_2_0148FD9B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h] 4_2_01512D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01453591 mov eax, dword ptr fs:[00000030h] 4_2_01453591
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h] 4_2_014865A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h] 4_2_014865A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h] 4_2_014865A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014835A1 mov eax, dword ptr fs:[00000030h] 4_2_014835A1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h] 4_2_01481DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h] 4_2_01481DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h] 4_2_01481DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015205AC mov eax, dword ptr fs:[00000030h] 4_2_015205AC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_015205AC mov eax, dword ptr fs:[00000030h] 4_2_015205AC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528450 mov eax, dword ptr fs:[00000030h] 4_2_01528450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148A44B mov eax, dword ptr fs:[00000030h] 4_2_0148A44B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EC450 mov eax, dword ptr fs:[00000030h] 4_2_014EC450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014EC450 mov eax, dword ptr fs:[00000030h] 4_2_014EC450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528C75 mov eax, dword ptr fs:[00000030h] 4_2_01528C75
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147746D mov eax, dword ptr fs:[00000030h] 4_2_0147746D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h] 4_2_0147B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h] 4_2_0148AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01495C70 mov eax, dword ptr fs:[00000030h] 4_2_01495C70
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528C14 mov eax, dword ptr fs:[00000030h] 4_2_01528C14
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h] 4_2_014D6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h] 4_2_014D6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h] 4_2_014D6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h] 4_2_014D6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h] 4_2_01511C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152740D mov eax, dword ptr fs:[00000030h] 4_2_0152740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152740D mov eax, dword ptr fs:[00000030h] 4_2_0152740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0152740D mov eax, dword ptr fs:[00000030h] 4_2_0152740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148BC2C mov eax, dword ptr fs:[00000030h] 4_2_0148BC2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h] 4_2_0146B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h] 4_2_0146B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h] 4_2_0146B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h] 4_2_01483C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h] 4_2_01483C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h] 4_2_01483C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01472430 mov eax, dword ptr fs:[00000030h] 4_2_01472430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01472430 mov eax, dword ptr fs:[00000030h] 4_2_01472430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01454439 mov eax, dword ptr fs:[00000030h] 4_2_01454439
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01528CD6 mov eax, dword ptr fs:[00000030h] 4_2_01528CD6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0148CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0148CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0148CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0148CCC0
Enables debug privileges
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Memory written: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior