Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Quotation-4834898943949883.pdf.exe

Overview

General Information

Sample Name:Quotation-4834898943949883.pdf.exe
Analysis ID:383906
MD5:57055ad7429ef21caca78a9428e8a332
SHA1:4df1aae070d95c2fd6c40ba3070a2af53462f3e6
SHA256:f15085a9037c117355a6b500780d5df0530a6c6724e4506622565b4c13582876
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.mcgeefamilychildcare.com/nc6m/"], "decoy": ["saltypar.com", "most.community", "johnmucollection.com", "houzzthings.net", "onemarketips.com", "legalmarketingtx.net", "criminalmindeddesign.com", "dtrinvesting.com", "millertaxpreparation.com", "wckfwwehmo.net", "begoodmeat.com", "tradefinance.fyi", "taxbizfunnels.com", "learnstartupdesign.com", "hxmdelights.com", "christiandantrust.faith", "dimensionshypnosis.com", "261391.com", "cancellednot.com", "paodanmeng.com", "thewayoutbooks.com", "halsdraincleaning.com", "jumlasx.xyz", "sutransformacion.com", "abisagne.com", "yingjiebj.com", "prodgra.com", "phone-review24.club", "weandvirus.com", "thelibertyhomeinspector.com", "fuckblarkie.com", "tappesupportservices.com", "marianiemorazzani.com", "skyybluchildkare.info", "diysecurityreview.com", "insuranceagentwilliams.com", "k-yahagigumi.com", "b3ourg.xyz", "mawhl.net", "billionartoffaith.com", "tech4thelolo.com", "vlvglobal.com", "positive-agenda-advisory.com", "sdzcsyy.com", "jxdiil.com", "craicing.com", "opinionesymodelos.com", "tulsaprintingcompany.com", "papaifotografo.com", "kalpavasi.com", "century21comingsoon.com", "bahiaprincipegrand.com", "tinwinsolar.ltd", "emprenviendo.com", "nineykal.com", "tam-rh.cat", "onlyfanscash.com", "florida-sunny.com", "workmone.online", "sastaafoods.com", "financiallyhealthy.life", "unudix.com", "wwwsumwater.com", "iparametricjobs.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
    00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x936b0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9392a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0xc00d0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0xc034a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9f44d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0xcbe6d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x9ef39:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0xcb959:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x9f54f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0xcbf6f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x9f6c7:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xcc0e7:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x94342:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0xc0d62:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x9e1b4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xcabd4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0x9503b:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0xc1a5b:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0xa52bf:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0xd1cdf:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0xa62c2:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0xa21e1:$sqlite3step: 68 34 1C 7B E1
      • 0xa22f4:$sqlite3step: 68 34 1C 7B E1
      • 0xcec01:$sqlite3step: 68 34 1C 7B E1
      • 0xced14:$sqlite3step: 68 34 1C 7B E1
      • 0xa2210:$sqlite3text: 68 38 2A 90 C5
      • 0xa2335:$sqlite3text: 68 38 2A 90 C5
      • 0xcec30:$sqlite3text: 68 38 2A 90 C5
      • 0xced55:$sqlite3text: 68 38 2A 90 C5
      • 0xa2223:$sqlite3blob: 68 53 D8 7F 8C
      • 0xa234b:$sqlite3blob: 68 53 D8 7F 8C
      • 0xcec43:$sqlite3blob: 68 53 D8 7F 8C
      • 0xced6b:$sqlite3blob: 68 53 D8 7F 8C
      00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1b4f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1c4fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x18419:$sqlite3step: 68 34 1C 7B E1
          • 0x1852c:$sqlite3step: 68 34 1C 7B E1
          • 0x18448:$sqlite3text: 68 38 2A 90 C5
          • 0x1856d:$sqlite3text: 68 38 2A 90 C5
          • 0x1845b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x18583:$sqlite3blob: 68 53 D8 7F 8C
          4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x1a6f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1b6fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            Click to see the 1 entries

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Antivirus detection for URL or domainShow sources
            Source: www.mcgeefamilychildcare.com/nc6m/Avira URL Cloud: Label: malware
            Found malware configurationShow sources
            Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.mcgeefamilychildcare.com/nc6m/"], "decoy": ["saltypar.com", "most.community", "johnmucollection.com", "houzzthings.net", "onemarketips.com", "legalmarketingtx.net", "criminalmindeddesign.com", "dtrinvesting.com", "millertaxpreparation.com", "wckfwwehmo.net", "begoodmeat.com", "tradefinance.fyi", "taxbizfunnels.com", "learnstartupdesign.com", "hxmdelights.com", "christiandantrust.faith", "dimensionshypnosis.com", "261391.com", "cancellednot.com", "paodanmeng.com", "thewayoutbooks.com", "halsdraincleaning.com", "jumlasx.xyz", "sutransformacion.com", "abisagne.com", "yingjiebj.com", "prodgra.com", "phone-review24.club", "weandvirus.com", "thelibertyhomeinspector.com", "fuckblarkie.com", "tappesupportservices.com", "marianiemorazzani.com", "skyybluchildkare.info", "diysecurityreview.com", "insuranceagentwilliams.com", "k-yahagigumi.com", "b3ourg.xyz", "mawhl.net", "billionartoffaith.com", "tech4thelolo.com", "vlvglobal.com", "positive-agenda-advisory.com", "sdzcsyy.com", "jxdiil.com", "craicing.com", "opinionesymodelos.com", "tulsaprintingcompany.com", "papaifotografo.com", "kalpavasi.com", "century21comingsoon.com", "bahiaprincipegrand.com", "tinwinsolar.ltd", "emprenviendo.com", "nineykal.com", "tam-rh.cat", "onlyfanscash.com", "florida-sunny.com", "workmone.online", "sastaafoods.com", "financiallyhealthy.life", "unudix.com", "wwwsumwater.com", "iparametricjobs.com"]}
            Multi AV Scanner detection for submitted fileShow sources
            Source: Quotation-4834898943949883.pdf.exeVirustotal: Detection: 26%Perma Link
            Source: Quotation-4834898943949883.pdf.exeReversingLabs: Detection: 22%
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE
            Machine Learning detection for sampleShow sources
            Source: Quotation-4834898943949883.pdf.exeJoe Sandbox ML: detected
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241176585.0000000001430000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then pop ebx

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: www.mcgeefamilychildcare.com/nc6m/
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000001.00000002.240654193.0000000002CE1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
            Source: Quotation-4834898943949883.pdf.exeString found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
            Source: Quotation-4834898943949883.pdf.exeString found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

            E-Banking Fraud:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Initial sample is a PE file and has a suspicious nameShow sources
            Source: initial sampleStatic PE information: Filename: Quotation-4834898943949883.pdf.exe
            Source: initial sampleStatic PE information: Filename: Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07716878 NtQueryInformationProcess,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07716873 NtQueryInformationProcess,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A060 NtClose,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A110 NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419F30 NtCreateFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419FE0 NtReadFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419F2A NtCreateFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419F82 NtCreateFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499660 NtAllocateVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014996E0 NtFreeVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499950 NtQueueApcThread,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499910 NtAdjustPrivilegesToken,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014999D0 NtCreateProcessEx,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014999A0 NtCreateSection,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0149B040 NtSuspendThread,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499840 NtDelayExecution,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499820 NtEnumerateKey,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014998F0 NtReadVirtualMemory,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014998A0 NtWriteVirtualMemory,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499B00 NtSetValueKey,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0149A3B0 NtGetContextThread,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499A50 NtCreateFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499A00 NtProtectVirtualMemory,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499A10 NtQuerySection,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499A20 NtResumeThread,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499A80 NtOpenDirectoryObject,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499540 NtReadFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499560 NtWriteFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499520 NtWaitForSingleObject,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0149AD30 NtSetContextThread,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014995D0 NtClose,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014995F0 NtQueryInformationFile,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0094DCE7
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0094A9EA
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_011BC2B0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_011B9990
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_04D70448
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_04D71770
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07715520
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07710740
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711FA8
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711F99
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711D60
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711D51
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0771A550
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07712D40
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0771A53F
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07715510
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_077114E0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_077114D1
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711B58
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07711B48
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07718BB0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07718BA3
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07716A10
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07712170
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07719170
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07712163
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07710938
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07710929
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07719180
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0094AAC7
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00401030
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00401209
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041DAFA
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D378
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409DFC
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00402D88
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00402D90
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409E40
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D631
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00402FB0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0097A9EA
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0097DCE7
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145F900
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01472990
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01456800
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511002
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152E824
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A830
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015228EC
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B090
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015220A8
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FCB4F
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147AB40
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01473360
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151231B
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01522B28
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151DBD2
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015103DA
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148ABD8
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014A8BE8
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015023E3
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148138B
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FEB8A
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147EB9A
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148EBB0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0150FA2B
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151E2C5
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015232A9
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015222AE
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01521D55
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01472D50
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01522D07
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01450D20
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015225DD
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146D5E0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482581
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014865A0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151D466
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146841F
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01472430
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0097AAC7
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: String function: 0145B150 appears 121 times
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: String function: 014E5720 appears 62 times
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: Quotation-4834898943949883.pdf.exeBinary or memory string: OriginalFilename vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245565115.0000000007680000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000000.217395296.0000000000942000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240654193.0000000002CE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.245113568.0000000006E30000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exeBinary or memory string: OriginalFilename vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000004.00000000.238479725.0000000000972000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241413507.000000000154F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exeBinary or memory string: OriginalFilenameReadBufferAsyncd97.exe4 vs Quotation-4834898943949883.pdf.exe
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.logJump to behavior
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\uwviaTyAYnlyFJcXtcTQZZrdZh
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: Quotation-4834898943949883.pdf.exeVirustotal: Detection: 26%
            Source: Quotation-4834898943949883.pdf.exeReversingLabs: Detection: 22%
            Source: unknownProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe 'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: Quotation-4834898943949883.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.241176585.0000000001430000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0094D65F push es; retn 0001h
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_0094DC4E push 00000000h; iretd
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 1_2_07716E6F pushfd ; retf
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D0D2 push eax; ret
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D0DB push eax; ret
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D085 push eax; ret
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D13C push eax; ret
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0040B3F8 push ebx; iretd
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041766B push eax; ret
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0040DF92 push ebp; retf
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041AFBA pushad ; retf
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0097DC4E push 00000000h; iretd
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0097D65F push es; retn 0001h
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014AD0D1 push ecx; ret
            Source: initial sampleStatic PE information: section name: .text entropy: 7.61748315782

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Uses an obfuscated file name to hide its real file extension (double extension)Show sources
            Source: Possible double extension: pdf.exeStatic PE information: Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion:

            barindex
            Yara detected AntiVM3Show sources
            Source: Yara matchFile source: 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: Quotation-4834898943949883.pdf.exe PID: 5956, type: MEMORY
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 5952Thread sleep time: -100018s >= -30000s
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 6028Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 100018
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 922337203685477
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: vmware
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: VMWARE
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
            Source: Quotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess queried: DebugPort
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01499860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511951 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145C962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151E962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528966 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01460100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01460100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01460100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01474120 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01453138 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014699C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015119D8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014531E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014E41E8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015289E7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147C182 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148A185 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482990 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484190 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151A189 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151A189 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145519E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145519E mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152F1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152F1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014861A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014861A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D69A6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015149A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148C9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148C9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014799BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511843 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01457057 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01470050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01470050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512073 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01521074 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147F86D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01456800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01456800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01456800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01524015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01524015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484020 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014570C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014570C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015118CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EB8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014540E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014558EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459080 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01453880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01453880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014990AF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014820A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014628AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F0BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145DB40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528B58 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145F358 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145DB60 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014E6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151131B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D53CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D53CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014853C5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014803E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01451BE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147DBE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015023E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015023E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015023E3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FEB8A mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014FEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01461B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01461B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0150D380 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01454B94 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148B390 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151138A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147EB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147EB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482397 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528BB6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01529BBE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01525BA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511BA8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151EA55 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01459240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511A5F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014E4257 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01495A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0150B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0150B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528A62 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0149927A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01468A0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455210 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01473A1C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01494A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01494A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01454A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01454A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01458239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01458239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01458239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482ACB mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01455AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01453ACA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528ADD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014512D4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482AE4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01514AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148DA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148DA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151129A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014552A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01451AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01485AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01485AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014812BD mov esi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014812BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014812BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148FAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145354C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145354C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01493D43 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D3540 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01503D40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01477D50 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01508D47 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01494D51 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01494D51 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01478D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01513518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01513518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01513518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151E539 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01463D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01484D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0145AD30 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014DA537 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0150FDD3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014515C1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01508DF1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014895EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014595F0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014595F0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01482581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01452D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0151B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01512D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01453591 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014865A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014835A1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01481DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015205AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_015205AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148A44B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EC450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014EC450 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528C75 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147746D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0147B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01495C70 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528C14 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_014D6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01511C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0152740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148BC2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0146B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01483C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01472430 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01472430 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01454439 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01528CD6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0148CCC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Injects a PE file into a foreign processesShow sources
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMemory written: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe base: 400000 value starts with: 4D5A
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Stealing of Sensitive Information:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

            Remote Access Functionality:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading11OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information14Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            Quotation-4834898943949883.pdf.exe27%VirustotalBrowse
            Quotation-4834898943949883.pdf.exe23%ReversingLabsWin32.Trojan.AgentTesla
            Quotation-4834898943949883.pdf.exe100%Joe Sandbox ML

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://tempuri.org/HighScoresDataSet.xsd0%Avira URL Cloudsafe
            www.mcgeefamilychildcare.com/nc6m/100%Avira URL Cloudmalware
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://tempuri.org/GridOneHSDataSet.xsd0%Avira URL Cloudsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.mcgeefamilychildcare.com/nc6m/true
            • Avira URL Cloud: malware
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://tempuri.org/HighScoresDataSet.xsdQuotation-4834898943949883.pdf.exefalse
            • Avira URL Cloud: safe
            		unknown
            http://www.apache.org/licenses/LICENSE-2.0Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
              		high
              http://www.fontbureau.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                		high
                http://www.fontbureau.com/designersGQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com/designers/?Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                    		high
                    http://www.founder.com.cn/cn/bTheQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designers?Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                      		high
                      http://tempuri.org/GridOneHSDataSet.xsdQuotation-4834898943949883.pdf.exefalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4Quotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmpfalse
                        		high
                        http://www.tiro.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designersQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                          		high
                          http://www.goodfont.co.krQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssQuotation-4834898943949883.pdf.exe, 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmpfalse
                            		high
                            http://www.carterandcone.comlQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/cabarga.htmlNQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/cTheQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.galapagosdesign.com/staff/dennis.htmQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://fontfabrik.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.founder.com.cn/cnQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/frere-jones.htmlQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                		high
                                http://www.jiyu-kobo.co.jp/Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.galapagosdesign.com/DPleaseQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers8Quotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.fonts.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                    		high
                                    http://www.sandoll.co.krQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.urwpp.deDPleaseQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.zhongyicts.com.cnQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameQuotation-4834898943949883.pdf.exe, 00000001.00000002.240759928.0000000002D72000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000001.00000002.240654193.0000000002CE1000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.sakkal.comQuotation-4834898943949883.pdf.exe, 00000001.00000002.245213081.0000000006F12000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown

                                      Contacted IPs

                                      No contacted IP infos

                                      General Information

                                      Joe Sandbox Version:31.0.0 Emerald
                                      Analysis ID:383906
                                      Start date:08.04.2021
                                      Start time:12:11:06
                                      Joe Sandbox Product:CloudBasic
                                      Overall analysis duration:0h 8m 44s
                                      Hypervisor based Inspection enabled:false
                                      Report type:light
                                      Sample file name:Quotation-4834898943949883.pdf.exe
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                      Number of analysed new started processes analysed:28
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • HDC enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Detection:MAL
                                      Classification:mal100.troj.evad.winEXE@3/1@0/0
                                      EGA Information:Failed
                                      HDC Information:
                                      • Successful, ratio: 4.8% (good quality ratio 4.7%)
                                      • Quality average: 79.7%
                                      • Quality standard deviation: 23.6%
                                      HCA Information:
                                      • Successful, ratio: 90%
                                      • Number of executed functions: 0
                                      • Number of non-executed functions: 0
                                      Cookbook Comments:
                                      • Adjust boot time
                                      • Enable AMSI
                                      • Found application associated with file extension: .exe
                                      Warnings:
                                      Show All
                                      • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe
                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      12:12:09API Interceptor1x Sleep call for process: Quotation-4834898943949883.pdf.exe modified

                                      Joe Sandbox View / Context

                                      IPs

                                      No context

                                      Domains

                                      No context

                                      ASN

                                      No context

                                      JA3 Fingerprints

                                      No context

                                      Dropped Files

                                      No context

                                      Created / dropped Files

                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.log
                                      Process:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                      File Type:ASCII text, with CRLF line terminators
                                      Category:dropped
                                      Size (bytes):1314
                                      Entropy (8bit):5.350128552078965
                                      Encrypted:false
                                      SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                      MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                      SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                      SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                      SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                      Malicious:true
                                      Reputation:high, very likely benign file
                                      Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                      Entropy (8bit):7.595750596480351
                                      TrID:
                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                      • Windows Screen Saver (13104/52) 0.07%
                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                      File name:Quotation-4834898943949883.pdf.exe
                                      File size:681472
                                      MD5:57055ad7429ef21caca78a9428e8a332
                                      SHA1:4df1aae070d95c2fd6c40ba3070a2af53462f3e6
                                      SHA256:f15085a9037c117355a6b500780d5df0530a6c6724e4506622565b4c13582876
                                      SHA512:afe126a28e09f69f5c4cb255a9baaa92ae94ca07ae7c93e257a4e7f9b1907d8c651b89bc938b11ba23244a1d32941e47b8ae1268a6ce342148d3653c16c5d7af
                                      SSDEEP:12288:kRRKtxL91LEPkJP/QHV6OcreeaAvV5vEqfkeH7zEfi/22A/4:kRREP1WkGV6/rxV5vEqfkiAq/e
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I{n`..............P.. ...D......N9... ...@....@.. ....................................@................................

                                      File Icon

                                      Icon Hash:2b014c5a4a450127

                                      Static PE Info

                                      General

                                      Entrypoint:0x4a394e
                                      Entrypoint Section:.text
                                      Digitally signed:false
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                      DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                      Time Stamp:0x606E7B49 [Thu Apr 8 03:40:57 2021 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:v4.0.30319
                                      OS Version Major:4
                                      OS Version Minor:0
                                      File Version Major:4
                                      File Version Minor:0
                                      Subsystem Version Major:4
                                      Subsystem Version Minor:0
                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                      Entrypoint Preview

                                      Instruction
                                      jmp dword ptr [00402000h]
                                      add dword ptr [eax], eax
                                      add byte ptr [eax], al
                                      add al, byte ptr [eax]
                                      add byte ptr [eax], al
                                      or byte ptr [eax], al
                                      add byte ptr [eax], al
                                      or eax, 0C000000h
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], al
                                      add byte ptr [eax], al
                                      pop es
                                      add byte ptr [eax], al
                                      add byte ptr [esi], al
                                      add byte ptr [eax], al
                                      add byte ptr [edx], cl
                                      add byte ptr [eax], al
                                      add byte ptr [esi], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], cl
                                      add byte ptr [eax], al
                                      push cs
                                      add byte ptr [eax], al
                                      add byte ptr [esi], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [esi], cl
                                      add byte ptr [eax], al
                                      add byte ptr [ecx], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax], cl
                                      add byte ptr [eax], al
                                      add byte ptr [ebx], al
                                      add byte ptr [eax], al
                                      add byte ptr [esi], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], al
                                      add byte ptr [eax], al
                                      pop es
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add al, byte ptr [eax]
                                      add byte ptr [eax], al
                                      push es
                                      add byte ptr [eax], al
                                      add byte ptr [edx], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], al
                                      add byte ptr [eax], al
                                      or al, byte ptr [eax]
                                      add byte ptr [eax], al
                                      push cs
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax], al
                                      add byte ptr [ecx], cl
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], cl
                                      add byte ptr [eax], al
                                      add eax, 00000000h
                                      add byte ptr [eax], al
                                      add byte ptr [ebx], al
                                      add byte ptr [eax], al
                                      add byte ptr [eax+eax], al
                                      add byte ptr [eax], al
                                      or eax, dword ptr [eax]
                                      add byte ptr [eax], al
                                      or eax, dword ptr [eax]
                                      add byte ptr [eax], al
                                      or al, 00h
                                      add byte ptr [eax], al
                                      or eax, 02000000h
                                      add byte ptr [eax], al
                                      add byte ptr [ecx], al
                                      add byte ptr [eax], al
                                      add byte ptr [edx], al
                                      add byte ptr [eax], al
                                      add byte ptr [esi], cl
                                      add byte ptr [eax], al
                                      add byte ptr [00000000h], al

                                      Data Directories

                                      NameVirtual AddressVirtual Size Is in Section
                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xa38fc0x4f.text
                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xa40000x41a8.rsrc
                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xaa0000xc.reloc
                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                      Sections

                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                      .text0x20000xa1e840xa2000False0.781325352045data7.61748315782IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                      .rsrc0xa40000x41a80x4200False0.222478693182data4.4812106987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                      .reloc0xaa0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                      Resources

                                      NameRVASizeTypeLanguageCountry
                                      RT_ICON0xa41900x468GLS_BINARY_LSB_FIRST
                                      RT_ICON0xa45f80x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295
                                      RT_ICON0xa56a00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295
                                      RT_GROUP_ICON0xa7c480x30data
                                      RT_VERSION0xa7c780x344data
                                      RT_MANIFEST0xa7fbc0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                      Imports

                                      DLLImport
                                      mscoree.dll_CorExeMain

                                      Version Infos

                                      DescriptionData
                                      Translation0x0000 0x04b0
                                      LegalCopyrightCopyright 2015
                                      Assembly Version1.0.0.0
                                      InternalNameReadBufferAsyncd97.exe
                                      FileVersion1.0.0.0
                                      CompanyName
                                      LegalTrademarks
                                      Comments
                                      ProductNameCodewords
                                      ProductVersion1.0.0.0
                                      FileDescriptionCodewords
                                      OriginalFilenameReadBufferAsyncd97.exe

                                      Network Behavior

                                      No network behavior found

                                      Code Manipulations

                                      Statistics

                                      Behavior

                                      Click to jump to process

                                      System Behavior

                                      Analysis Process: Quotation-4834898943949883.pdf.exe PID: 5956 Parent PID: 5488

                                      General

                                      Start time:12:12:01
                                      Start date:08/04/2021
                                      Path:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                      Wow64 process (32bit):true
                                      Commandline:'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
                                      Imagebase:0x940000
                                      File size:681472 bytes
                                      MD5 hash:57055AD7429EF21CACA78A9428E8A332
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:.Net C# or VB.NET
                                      Yara matches:
                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.240710316.0000000002D35000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, Author: Joe Security
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.241153701.0000000003DA3000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:low

                                      Analysis Process: Quotation-4834898943949883.pdf.exe PID: 4120 Parent PID: 5956

                                      General

                                      Start time:12:12:11
                                      Start date:08/04/2021
                                      Path:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                      Wow64 process (32bit):true
                                      Commandline:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                      Imagebase:0x970000
                                      File size:681472 bytes
                                      MD5 hash:57055AD7429EF21CACA78A9428E8A332
                                      Has elevated privileges:true
                                      Has administrator privileges:true
                                      Programmed in:C, C++ or other language
                                      Yara matches:
                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.240662044.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                      Reputation:low

                                      Disassembly

                                      Code Analysis

                                      Reset < >