Analysis Report Quotation-4834898943949883.pdf.exe

Overview

General Information

Sample Name: Quotation-4834898943949883.pdf.exe
Analysis ID: 383932
MD5: ba34da45fb03afddde208fd6458ac143
SHA1: e132408554f22f314f3e4e151d931de1d3e623e1
SHA256: f7b3ef9d4ac8560bf644a3f3039a32f568563d3299273073abe31fa19ed6470e
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: www.liveonlinehdplay24.com/kzsw/ Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.liveonlinehdplay24.com/kzsw/"], "decoy": ["thelargedoor.com", "newcuus.com", "tgc.xyz", "americanrvwarranties.com", "deroshop.com", "wagyu-importer.com", "frbhomeloan.com", "taniabeautysalonspa.com", "nac-alerton.com", "ordersudsy.com", "villagegardengreeley.com", "locksmithpembrokepines.com", "rafsanjan.net", "jumlasx.xyz", "supermercadoveganmadrid.com", "rubsalmon.com", "glenhelensaturdaymotocross.com", "jichuang888.club", "aajnv.com", "stackablesllc.com", "elevatebuilder.com", "higrandtechnologies.com", "lssqzyg.com", "zjszxs.com", "ssgasiu.com", "brianterrymarketing.com", "nyatiera.com", "elemetasu.com", "larouedesecours.info", "customerye.com", "riotgentler.com", "wwwjeansjewerlys.com", "egyptcon.com", "hona-iq.com", "residsfranchise.com", "flamingogrouprealty.com", "windycitywoodturners.club", "maineguidedfishing.com", "krushirajyafarms.com", "scottsdaledrycleanaz.com", "eisdjsd.asia", "gelgoodplus.com", "numericcarbon.com", "zszq665.com", "researchripples.com", "pravschool.com", "lanshan1688.com", "bashcovid19.com", "enableauth.com", "azbibi.com", "nearyapi.com", "cqshenchi.com", "ipandasz.com", "persero14.com", "lemonadecrystal.com", "sekrema2049.com", "chilternss.com", "bestsgiftstore.com", "vlansi.icu", "namasteyg.com", "msjshelfit.com", "harbee.net", "smiley.team", "sopnosoft.com"]}
Multi AV Scanner detection for submitted file
Source: Quotation-4834898943949883.pdf.exe ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: Quotation-4834898943949883.pdf.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Quotation-4834898943949883.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Quotation-4834898943949883.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670713735.0000000001710000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_04C81B98
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_04C81BA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_073CFB08
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then pop esi 4_2_004172DB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then pop ebx 4_2_00407B04
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4x nop then pop edi 4_2_00417D8E

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.liveonlinehdplay24.com/kzsw/
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670815248.0000000002C01000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
Source: Quotation-4834898943949883.pdf.exe String found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
Source: Quotation-4834898943949883.pdf.exe String found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comB.TTF
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnate0
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnrig
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.659748125.0000000005CCA000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/A
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/B
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/H
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/n
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Z
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/g
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/A
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/B
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/u
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670586004.00000000010CB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Quotation-4834898943949883.pdf.exe
Source: initial sample Static PE information: Filename: Quotation-4834898943949883.pdf.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6688 NtQueryInformationProcess, 0_2_073C6688
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6680 NtQueryInformationProcess, 0_2_073C6680
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A060 NtClose, 4_2_0041A060
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A110 NtAllocateVirtualMemory, 4_2_0041A110
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419F30 NtCreateFile, 4_2_00419F30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419FE0 NtReadFile, 4_2_00419FE0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A05A NtClose, 4_2_0041A05A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041A10D NtAllocateVirtualMemory, 4_2_0041A10D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00419FDB NtCreateFile,NtReadFile, 4_2_00419FDB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_01779860
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779660 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_01779660
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017796E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_017796E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779950 NtQueueApcThread, 4_2_01779950
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779910 NtAdjustPrivilegesToken, 4_2_01779910
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017799D0 NtCreateProcessEx, 4_2_017799D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017799A0 NtCreateSection, 4_2_017799A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177B040 NtSuspendThread, 4_2_0177B040
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779840 NtDelayExecution, 4_2_01779840
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779820 NtEnumerateKey, 4_2_01779820
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017798F0 NtReadVirtualMemory, 4_2_017798F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017798A0 NtWriteVirtualMemory, 4_2_017798A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779B00 NtSetValueKey, 4_2_01779B00
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177A3B0 NtGetContextThread, 4_2_0177A3B0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779A50 NtCreateFile, 4_2_01779A50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779A20 NtResumeThread, 4_2_01779A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779A10 NtQuerySection, 4_2_01779A10
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779A00 NtProtectVirtualMemory, 4_2_01779A00
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779A80 NtOpenDirectoryObject, 4_2_01779A80
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779560 NtWriteFile, 4_2_01779560
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779540 NtReadFile, 4_2_01779540
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177AD30 NtSetContextThread, 4_2_0177AD30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779520 NtWaitForSingleObject, 4_2_01779520
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017795F0 NtQueryInformationFile, 4_2_017795F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017795D0 NtClose, 4_2_017795D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177A770 NtOpenThread, 4_2_0177A770
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779770 NtSetInformationFile, 4_2_01779770
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779760 NtOpenProcess, 4_2_01779760
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779730 NtQueryVirtualMemory, 4_2_01779730
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779710 NtQueryInformationToken, 4_2_01779710
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177A710 NtOpenProcessToken, 4_2_0177A710
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779FE0 NtCreateMutant, 4_2_01779FE0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017797A0 NtUnmapViewOfSection, 4_2_017797A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779780 NtMapViewOfSection, 4_2_01779780
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779670 NtQueryInformationProcess, 4_2_01779670
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779650 NtQueryValueKey, 4_2_01779650
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779610 NtEnumerateValueKey, 4_2_01779610
Detected potential crypto function
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_04C80448 0_2_04C80448
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_04C81770 0_2_04C81770
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C5300 0_2_073C5300
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6FC0 0_2_073C6FC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1ED8 0_2_073C1ED8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6FB6 0_2_073C6FB6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C2A08 0_2_073C2A08
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1A70 0_2_073C1A70
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C06B9 0_2_073C06B9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1A80 0_2_073C1A80
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C52EF 0_2_073C52EF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C06C8 0_2_073C06C8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1ECA 0_2_073C1ECA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C8518 0_2_073C8518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C8508 0_2_073C8508
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C2978 0_2_073C2978
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C29BF 0_2_073C29BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C11A0 0_2_073C11A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C5598 0_2_073C5598
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1190 0_2_073C1190
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C5588 0_2_073C5588
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C89F8 0_2_073C89F8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C89E8 0_2_073C89E8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6820 0_2_073C6820
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1810 0_2_073C1810
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C6812 0_2_073C6812
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1800 0_2_073C1800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C5C78 0_2_073C5C78
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1CB1 0_2_073C1CB1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C5C88 0_2_073C5C88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C8CE8 0_2_073C8CE8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C8CD8 0_2_073C8CD8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C1CC0 0_2_073C1CC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00401028 4_2_00401028
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D91B 4_2_0041D91B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041E1A8 4_2_0041E1A8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D21B 4_2_0041D21B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041ECBA 4_2_0041ECBA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409E40 4_2_00409E40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409E3B 4_2_00409E3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00402FB0 4_2_00402FB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041E7BA 4_2_0041E7BA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173F900 4_2_0173F900
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01752990 4_2_01752990
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018020A8 4_2_018020A8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A830 4_2_0175A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018028EC 4_2_018028EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736800 4_2_01736800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1002 4_2_017F1002
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180E824 4_2_0180E824
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B090 4_2_0174B090
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01753360 4_2_01753360
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DCB4F 4_2_017DCB4F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175AB40 4_2_0175AB40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F231B 4_2_017F231B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01788BE8 4_2_01788BE8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E23E3 4_2_017E23E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F03DA 4_2_017F03DA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01802B28 4_2_01802B28
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FDBD2 4_2_017FDBD2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176ABD8 4_2_0176ABD8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176EBB0 4_2_0176EBB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175EB9A 4_2_0175EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DEB8A 4_2_017DEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176138B 4_2_0176138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018032A9 4_2_018032A9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018022AE 4_2_018022AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017EFA2B 4_2_017EFA2B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FE2C5 4_2_017FE2C5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01752D50 4_2_01752D50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01730D20 4_2_01730D20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018025DD 4_2_018025DD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01802D07 4_2_01802D07
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174D5E0 4_2_0174D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01801D55 4_2_01801D55
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017665A0 4_2_017665A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762581 4_2_01762581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FD466 4_2_017FD466
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01752430 4_2_01752430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174841F 4_2_0174841F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180DFCE 4_2_0180DFCE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01801FF1 4_2_01801FF1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F67E2 4_2_017F67E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017BAE60 4_2_017BAE60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01756E30 4_2_01756E30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FD616 4_2_017FD616
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01755600 4_2_01755600
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01802EF7 4_2_01802EF7
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: String function: 0173B150 appears 154 times
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: String function: 0178D08C appears 40 times
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: String function: 017C5720 appears 78 times
PE file contains strange resources
Source: Quotation-4834898943949883.pdf.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676889901.0000000008C00000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676251652.0000000007330000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676714401.0000000008AE0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670058848.00000000009A8000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670586004.00000000010CB000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.671469145.00000000019BF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670473061.0000000000D28000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
Source: Quotation-4834898943949883.pdf.exe Binary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
Uses 32bit PE files
Source: Quotation-4834898943949883.pdf.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Quotation-4834898943949883.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.log Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Mutant created: \Sessions\1\BaseNamedObjects\dAcuDULllAP
Source: Quotation-4834898943949883.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Quotation-4834898943949883.pdf.exe ReversingLabs: Detection: 29%
Source: unknown Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe 'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Quotation-4834898943949883.pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Quotation-4834898943949883.pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670713735.0000000001710000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 0_2_073C7408 pushad ; iretd 0_2_073C7409
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041702F push ds; ret 4_2_004170F8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D0D2 push eax; ret 4_2_0041D0D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D0DB push eax; ret 4_2_0041D142
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_004170F9 push ds; ret 4_2_004170F8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D085 push eax; ret 4_2_0041D0D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041D13C push eax; ret 4_2_0041D142
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0040F1E9 push ecx; iretd 4_2_0040F1EB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00417988 push ebp; iretd 4_2_00417989
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0040E40C push eax; ret 4_2_0040E420
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0040E421 push ebx; iretd 4_2_0040E42B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00416567 push 0C21EF33h; retf 4_2_0041656D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041E571 push eax; ret 4_2_0041E573
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0041663D push es; retf 4_2_0041664C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00416FD9 push ds; ret 4_2_004170F8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0178D0D1 push ecx; ret 4_2_0178D0E4
Source: initial sample Static PE information: section name: .text entropy: 7.62426000662

Hooking and other Techniques for Hiding and Protection:

barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: Quotation-4834898943949883.pdf.exe
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Quotation-4834898943949883.pdf.exe PID: 7052, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 7056 Thread sleep time: -103486s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 7072 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 103486 Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_00409A90 rdtsc 4_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01779860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_01779860
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173B171 mov eax, dword ptr fs:[00000030h] 4_2_0173B171
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173B171 mov eax, dword ptr fs:[00000030h] 4_2_0173B171
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173C962 mov eax, dword ptr fs:[00000030h] 4_2_0173C962
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FE962 mov eax, dword ptr fs:[00000030h] 4_2_017FE962
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173395E mov eax, dword ptr fs:[00000030h] 4_2_0173395E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173395E mov eax, dword ptr fs:[00000030h] 4_2_0173395E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1951 mov eax, dword ptr fs:[00000030h] 4_2_017F1951
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B944 mov eax, dword ptr fs:[00000030h] 4_2_0175B944
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B944 mov eax, dword ptr fs:[00000030h] 4_2_0175B944
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0180F1B5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0180F1B5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01733138 mov ecx, dword ptr fs:[00000030h] 4_2_01733138
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176513A mov eax, dword ptr fs:[00000030h] 4_2_0176513A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176513A mov eax, dword ptr fs:[00000030h] 4_2_0176513A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 mov eax, dword ptr fs:[00000030h] 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 mov eax, dword ptr fs:[00000030h] 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 mov eax, dword ptr fs:[00000030h] 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 mov eax, dword ptr fs:[00000030h] 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01754120 mov ecx, dword ptr fs:[00000030h] 4_2_01754120
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018089E7 mov eax, dword ptr fs:[00000030h] 4_2_018089E7
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739100 mov eax, dword ptr fs:[00000030h] 4_2_01739100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739100 mov eax, dword ptr fs:[00000030h] 4_2_01739100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739100 mov eax, dword ptr fs:[00000030h] 4_2_01739100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01740100 mov eax, dword ptr fs:[00000030h] 4_2_01740100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01740100 mov eax, dword ptr fs:[00000030h] 4_2_01740100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01740100 mov eax, dword ptr fs:[00000030h] 4_2_01740100
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0173B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0173B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0173B1E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017331E0 mov eax, dword ptr fs:[00000030h] 4_2_017331E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C41E8 mov eax, dword ptr fs:[00000030h] 4_2_017C41E8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F19D8 mov eax, dword ptr fs:[00000030h] 4_2_017F19D8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h] 4_2_017B51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h] 4_2_017B51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h] 4_2_017B51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h] 4_2_017B51BE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176C9BF mov eax, dword ptr fs:[00000030h] 4_2_0176C9BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176C9BF mov eax, dword ptr fs:[00000030h] 4_2_0176C9BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov eax, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov eax, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov eax, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017599BF mov eax, dword ptr fs:[00000030h] 4_2_017599BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017661A0 mov eax, dword ptr fs:[00000030h] 4_2_017661A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017661A0 mov eax, dword ptr fs:[00000030h] 4_2_017661A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h] 4_2_017F49A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h] 4_2_017F49A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h] 4_2_017F49A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h] 4_2_017F49A4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B69A6 mov eax, dword ptr fs:[00000030h] 4_2_017B69A6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762990 mov eax, dword ptr fs:[00000030h] 4_2_01762990
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764190 mov eax, dword ptr fs:[00000030h] 4_2_01764190
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808966 mov eax, dword ptr fs:[00000030h] 4_2_01808966
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173519E mov eax, dword ptr fs:[00000030h] 4_2_0173519E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173519E mov ecx, dword ptr fs:[00000030h] 4_2_0173519E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176A185 mov eax, dword ptr fs:[00000030h] 4_2_0176A185
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FA189 mov eax, dword ptr fs:[00000030h] 4_2_017FA189
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FA189 mov ecx, dword ptr fs:[00000030h] 4_2_017FA189
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175C182 mov eax, dword ptr fs:[00000030h] 4_2_0175C182
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2073 mov eax, dword ptr fs:[00000030h] 4_2_017F2073
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175F86D mov eax, dword ptr fs:[00000030h] 4_2_0175F86D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735050 mov eax, dword ptr fs:[00000030h] 4_2_01735050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735050 mov eax, dword ptr fs:[00000030h] 4_2_01735050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735050 mov eax, dword ptr fs:[00000030h] 4_2_01735050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01737057 mov eax, dword ptr fs:[00000030h] 4_2_01737057
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01750050 mov eax, dword ptr fs:[00000030h] 4_2_01750050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01750050 mov eax, dword ptr fs:[00000030h] 4_2_01750050
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1843 mov eax, dword ptr fs:[00000030h] 4_2_017F1843
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h] 4_2_0175A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h] 4_2_0175A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h] 4_2_0175A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h] 4_2_0175A830
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764020 mov edi, dword ptr fs:[00000030h] 4_2_01764020
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176002D mov eax, dword ptr fs:[00000030h] 4_2_0176002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176002D mov eax, dword ptr fs:[00000030h] 4_2_0176002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176002D mov eax, dword ptr fs:[00000030h] 4_2_0176002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176002D mov eax, dword ptr fs:[00000030h] 4_2_0176002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176002D mov eax, dword ptr fs:[00000030h] 4_2_0176002D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h] 4_2_0174B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h] 4_2_0174B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h] 4_2_0174B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h] 4_2_0174B02A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h] 4_2_017B7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h] 4_2_017B7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h] 4_2_017B7016
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736800 mov eax, dword ptr fs:[00000030h] 4_2_01736800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736800 mov eax, dword ptr fs:[00000030h] 4_2_01736800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736800 mov eax, dword ptr fs:[00000030h] 4_2_01736800
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428FD mov eax, dword ptr fs:[00000030h] 4_2_017428FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428FD mov eax, dword ptr fs:[00000030h] 4_2_017428FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428FD mov eax, dword ptr fs:[00000030h] 4_2_017428FD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B8E4 mov eax, dword ptr fs:[00000030h] 4_2_0175B8E4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B8E4 mov eax, dword ptr fs:[00000030h] 4_2_0175B8E4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h] 4_2_017340E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h] 4_2_017340E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h] 4_2_017340E1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01804015 mov eax, dword ptr fs:[00000030h] 4_2_01804015
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01804015 mov eax, dword ptr fs:[00000030h] 4_2_01804015
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017358EC mov eax, dword ptr fs:[00000030h] 4_2_017358EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov ecx, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h] 4_2_017CB8D0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017370C0 mov eax, dword ptr fs:[00000030h] 4_2_017370C0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017370C0 mov eax, dword ptr fs:[00000030h] 4_2_017370C0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F18CA mov eax, dword ptr fs:[00000030h] 4_2_017F18CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F0BF mov ecx, dword ptr fs:[00000030h] 4_2_0176F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F0BF mov eax, dword ptr fs:[00000030h] 4_2_0176F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F0BF mov eax, dword ptr fs:[00000030h] 4_2_0176F0BF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h] 4_2_017620A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017790AF mov eax, dword ptr fs:[00000030h] 4_2_017790AF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov eax, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov eax, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov eax, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov ecx, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov eax, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017428AE mov eax, dword ptr fs:[00000030h] 4_2_017428AE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739080 mov eax, dword ptr fs:[00000030h] 4_2_01739080
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01733880 mov eax, dword ptr fs:[00000030h] 4_2_01733880
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01733880 mov eax, dword ptr fs:[00000030h] 4_2_01733880
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01801074 mov eax, dword ptr fs:[00000030h] 4_2_01801074
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B3884 mov eax, dword ptr fs:[00000030h] 4_2_017B3884
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B3884 mov eax, dword ptr fs:[00000030h] 4_2_017B3884
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h] 4_2_0174F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h] 4_2_0174F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h] 4_2_0174F370
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B7A mov eax, dword ptr fs:[00000030h] 4_2_01763B7A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B7A mov eax, dword ptr fs:[00000030h] 4_2_01763B7A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173DB60 mov ecx, dword ptr fs:[00000030h] 4_2_0173DB60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h] 4_2_017C6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h] 4_2_017C6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h] 4_2_017C6365
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01805BA5 mov eax, dword ptr fs:[00000030h] 4_2_01805BA5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173F358 mov eax, dword ptr fs:[00000030h] 4_2_0173F358
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h] 4_2_01763B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h] 4_2_01763B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h] 4_2_01763B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h] 4_2_01763B5A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173DB40 mov eax, dword ptr fs:[00000030h] 4_2_0173DB40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808BB6 mov eax, dword ptr fs:[00000030h] 4_2_01808BB6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01809BBE mov eax, dword ptr fs:[00000030h] 4_2_01809BBE
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F131B mov eax, dword ptr fs:[00000030h] 4_2_017F131B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h] 4_2_0175A309
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h] 4_2_017603E2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01731BE9 mov eax, dword ptr fs:[00000030h] 4_2_01731BE9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175DBE9 mov eax, dword ptr fs:[00000030h] 4_2_0175DBE9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E23E3 mov ecx, dword ptr fs:[00000030h] 4_2_017E23E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E23E3 mov ecx, dword ptr fs:[00000030h] 4_2_017E23E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E23E3 mov eax, dword ptr fs:[00000030h] 4_2_017E23E3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B53CA mov eax, dword ptr fs:[00000030h] 4_2_017B53CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B53CA mov eax, dword ptr fs:[00000030h] 4_2_017B53CA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017653C5 mov eax, dword ptr fs:[00000030h] 4_2_017653C5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1BA8 mov eax, dword ptr fs:[00000030h] 4_2_017F1BA8
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808B58 mov eax, dword ptr fs:[00000030h] 4_2_01808B58
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h] 4_2_01764BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h] 4_2_01764BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h] 4_2_01764BAD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762397 mov eax, dword ptr fs:[00000030h] 4_2_01762397
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176B390 mov eax, dword ptr fs:[00000030h] 4_2_0176B390
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01734B94 mov edi, dword ptr fs:[00000030h] 4_2_01734B94
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175EB9A mov eax, dword ptr fs:[00000030h] 4_2_0175EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175EB9A mov eax, dword ptr fs:[00000030h] 4_2_0175EB9A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F138A mov eax, dword ptr fs:[00000030h] 4_2_017F138A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DEB8A mov ecx, dword ptr fs:[00000030h] 4_2_017DEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h] 4_2_017DEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h] 4_2_017DEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h] 4_2_017DEB8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01741B8F mov eax, dword ptr fs:[00000030h] 4_2_01741B8F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01741B8F mov eax, dword ptr fs:[00000030h] 4_2_01741B8F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176138B mov eax, dword ptr fs:[00000030h] 4_2_0176138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176138B mov eax, dword ptr fs:[00000030h] 4_2_0176138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176138B mov eax, dword ptr fs:[00000030h] 4_2_0176138B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017ED380 mov ecx, dword ptr fs:[00000030h] 4_2_017ED380
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0177927A mov eax, dword ptr fs:[00000030h] 4_2_0177927A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017EB260 mov eax, dword ptr fs:[00000030h] 4_2_017EB260
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017EB260 mov eax, dword ptr fs:[00000030h] 4_2_017EB260
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h] 4_2_01775A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h] 4_2_01775A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h] 4_2_01775A69
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1A5F mov eax, dword ptr fs:[00000030h] 4_2_017F1A5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FEA55 mov eax, dword ptr fs:[00000030h] 4_2_017FEA55
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C4257 mov eax, dword ptr fs:[00000030h] 4_2_017C4257
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739240 mov eax, dword ptr fs:[00000030h] 4_2_01739240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739240 mov eax, dword ptr fs:[00000030h] 4_2_01739240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739240 mov eax, dword ptr fs:[00000030h] 4_2_01739240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01739240 mov eax, dword ptr fs:[00000030h] 4_2_01739240
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h] 4_2_0175B236
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01738239 mov eax, dword ptr fs:[00000030h] 4_2_01738239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01738239 mov eax, dword ptr fs:[00000030h] 4_2_01738239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01738239 mov eax, dword ptr fs:[00000030h] 4_2_01738239
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01734A20 mov eax, dword ptr fs:[00000030h] 4_2_01734A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01734A20 mov eax, dword ptr fs:[00000030h] 4_2_01734A20
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1229 mov eax, dword ptr fs:[00000030h] 4_2_017F1229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01774A2C mov eax, dword ptr fs:[00000030h] 4_2_01774A2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01774A2C mov eax, dword ptr fs:[00000030h] 4_2_01774A2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h] 4_2_0175A229
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808ADD mov eax, dword ptr fs:[00000030h] 4_2_01808ADD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735210 mov eax, dword ptr fs:[00000030h] 4_2_01735210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735210 mov ecx, dword ptr fs:[00000030h] 4_2_01735210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735210 mov eax, dword ptr fs:[00000030h] 4_2_01735210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735210 mov eax, dword ptr fs:[00000030h] 4_2_01735210
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173AA16 mov eax, dword ptr fs:[00000030h] 4_2_0173AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173AA16 mov eax, dword ptr fs:[00000030h] 4_2_0173AA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01753A1C mov eax, dword ptr fs:[00000030h] 4_2_01753A1C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FAA16 mov eax, dword ptr fs:[00000030h] 4_2_017FAA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FAA16 mov eax, dword ptr fs:[00000030h] 4_2_017FAA16
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01748A0A mov eax, dword ptr fs:[00000030h] 4_2_01748A0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h] 4_2_017F4AEF
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762AE4 mov eax, dword ptr fs:[00000030h] 4_2_01762AE4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017312D4 mov eax, dword ptr fs:[00000030h] 4_2_017312D4
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h] 4_2_01735AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h] 4_2_01735AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h] 4_2_01735AC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01733ACA mov eax, dword ptr fs:[00000030h] 4_2_01733ACA
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762ACB mov eax, dword ptr fs:[00000030h] 4_2_01762ACB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0174AAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174AAB0 mov eax, dword ptr fs:[00000030h] 4_2_0174AAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176FAB0 mov eax, dword ptr fs:[00000030h] 4_2_0176FAB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017612BD mov esi, dword ptr fs:[00000030h] 4_2_017612BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017612BD mov eax, dword ptr fs:[00000030h] 4_2_017612BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017612BD mov eax, dword ptr fs:[00000030h] 4_2_017612BD
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01731AA0 mov eax, dword ptr fs:[00000030h] 4_2_01731AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h] 4_2_017352A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h] 4_2_017352A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h] 4_2_017352A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h] 4_2_017352A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h] 4_2_017352A5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01765AA0 mov eax, dword ptr fs:[00000030h] 4_2_01765AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01765AA0 mov eax, dword ptr fs:[00000030h] 4_2_01765AA0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176D294 mov eax, dword ptr fs:[00000030h] 4_2_0176D294
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176D294 mov eax, dword ptr fs:[00000030h] 4_2_0176D294
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808A62 mov eax, dword ptr fs:[00000030h] 4_2_01808A62
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F129A mov eax, dword ptr fs:[00000030h] 4_2_017F129A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176DA88 mov eax, dword ptr fs:[00000030h] 4_2_0176DA88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176DA88 mov eax, dword ptr fs:[00000030h] 4_2_0176DA88
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175C577 mov eax, dword ptr fs:[00000030h] 4_2_0175C577
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175C577 mov eax, dword ptr fs:[00000030h] 4_2_0175C577
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h] 4_2_01758D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h] 4_2_01758D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h] 4_2_01758D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h] 4_2_01758D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h] 4_2_01758D76
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01757D50 mov eax, dword ptr fs:[00000030h] 4_2_01757D50
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01774D51 mov eax, dword ptr fs:[00000030h] 4_2_01774D51
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01774D51 mov eax, dword ptr fs:[00000030h] 4_2_01774D51
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018005AC mov eax, dword ptr fs:[00000030h] 4_2_018005AC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_018005AC mov eax, dword ptr fs:[00000030h] 4_2_018005AC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01773D43 mov eax, dword ptr fs:[00000030h] 4_2_01773D43
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E8D47 mov eax, dword ptr fs:[00000030h] 4_2_017E8D47
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B3540 mov eax, dword ptr fs:[00000030h] 4_2_017B3540
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E3D40 mov eax, dword ptr fs:[00000030h] 4_2_017E3D40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173354C mov eax, dword ptr fs:[00000030h] 4_2_0173354C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173354C mov eax, dword ptr fs:[00000030h] 4_2_0173354C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h] 4_2_01743D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173AD30 mov eax, dword ptr fs:[00000030h] 4_2_0173AD30
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FE539 mov eax, dword ptr fs:[00000030h] 4_2_017FE539
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017BA537 mov eax, dword ptr fs:[00000030h] 4_2_017BA537
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h] 4_2_01764D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h] 4_2_01764D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h] 4_2_01764D3B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h] 4_2_0176F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h] 4_2_0176F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h] 4_2_0176F527
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h] 4_2_017F3518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h] 4_2_017F3518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h] 4_2_017F3518
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017395F0 mov eax, dword ptr fs:[00000030h] 4_2_017395F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017395F0 mov ecx, dword ptr fs:[00000030h] 4_2_017395F0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017E8DF1 mov eax, dword ptr fs:[00000030h] 4_2_017E8DF1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0174D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174D5E0 mov eax, dword ptr fs:[00000030h] 4_2_0174D5E0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017695EC mov eax, dword ptr fs:[00000030h] 4_2_017695EC
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h] 4_2_017FFDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h] 4_2_017FFDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h] 4_2_017FFDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h] 4_2_017FFDE2
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017EFDD3 mov eax, dword ptr fs:[00000030h] 4_2_017EFDD3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov ecx, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h] 4_2_017B6DC9
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017315C1 mov eax, dword ptr fs:[00000030h] 4_2_017315C1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808D34 mov eax, dword ptr fs:[00000030h] 4_2_01808D34
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h] 4_2_01761DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h] 4_2_01761DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h] 4_2_01761DB5
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h] 4_2_017665A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h] 4_2_017665A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h] 4_2_017665A0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017635A1 mov eax, dword ptr fs:[00000030h] 4_2_017635A1
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01733591 mov eax, dword ptr fs:[00000030h] 4_2_01733591
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176FD9B mov eax, dword ptr fs:[00000030h] 4_2_0176FD9B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176FD9B mov eax, dword ptr fs:[00000030h] 4_2_0176FD9B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762581 mov eax, dword ptr fs:[00000030h] 4_2_01762581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762581 mov eax, dword ptr fs:[00000030h] 4_2_01762581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762581 mov eax, dword ptr fs:[00000030h] 4_2_01762581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01762581 mov eax, dword ptr fs:[00000030h] 4_2_01762581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h] 4_2_01732D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h] 4_2_01732D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h] 4_2_01732D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h] 4_2_01732D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h] 4_2_01732D8A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h] 4_2_017F2D82
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h] 4_2_017FB581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h] 4_2_017FB581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h] 4_2_017FB581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h] 4_2_017FB581
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h] 4_2_0175B477
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01775C70 mov eax, dword ptr fs:[00000030h] 4_2_01775C70
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h] 4_2_0176AC7B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175746D mov eax, dword ptr fs:[00000030h] 4_2_0175746D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CC450 mov eax, dword ptr fs:[00000030h] 4_2_017CC450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017CC450 mov eax, dword ptr fs:[00000030h] 4_2_017CC450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01809CB3 mov eax, dword ptr fs:[00000030h] 4_2_01809CB3
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176A44B mov eax, dword ptr fs:[00000030h] 4_2_0176A44B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01752430 mov eax, dword ptr fs:[00000030h] 4_2_01752430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01752430 mov eax, dword ptr fs:[00000030h] 4_2_01752430
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h] 4_2_0174B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h] 4_2_0174B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h] 4_2_0174B433
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h] 4_2_01763C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h] 4_2_01763C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h] 4_2_01763C3E
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01734439 mov eax, dword ptr fs:[00000030h] 4_2_01734439
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808CD6 mov eax, dword ptr fs:[00000030h] 4_2_01808CD6
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176BC2C mov eax, dword ptr fs:[00000030h] 4_2_0176BC2C
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h] 4_2_017B6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h] 4_2_017B6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h] 4_2_017B6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h] 4_2_017B6C0A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h] 4_2_017F1C06
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F14FB mov eax, dword ptr fs:[00000030h] 4_2_017F14FB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h] 4_2_017B6CF0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h] 4_2_017B6CF0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h] 4_2_017B6CF0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180740D mov eax, dword ptr fs:[00000030h] 4_2_0180740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180740D mov eax, dword ptr fs:[00000030h] 4_2_0180740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0180740D mov eax, dword ptr fs:[00000030h] 4_2_0180740D
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808C14 mov eax, dword ptr fs:[00000030h] 4_2_01808C14
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01732CDB mov eax, dword ptr fs:[00000030h] 4_2_01732CDB
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0176CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0176CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0176CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h] 4_2_0176CCC0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01734CB0 mov eax, dword ptr fs:[00000030h] 4_2_01734CB0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176D4B0 mov eax, dword ptr fs:[00000030h] 4_2_0176D4B0
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808450 mov eax, dword ptr fs:[00000030h] 4_2_01808450
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173649B mov eax, dword ptr fs:[00000030h] 4_2_0173649B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173649B mov eax, dword ptr fs:[00000030h] 4_2_0173649B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h] 4_2_017F4496
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174849B mov eax, dword ptr fs:[00000030h] 4_2_0174849B
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01731480 mov eax, dword ptr fs:[00000030h] 4_2_01731480
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01808C75 mov eax, dword ptr fs:[00000030h] 4_2_01808C75
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736F60 mov eax, dword ptr fs:[00000030h] 4_2_01736F60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_01736F60 mov eax, dword ptr fs:[00000030h] 4_2_01736F60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174FF60 mov eax, dword ptr fs:[00000030h] 4_2_0174FF60
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175E760 mov eax, dword ptr fs:[00000030h] 4_2_0175E760
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0175E760 mov eax, dword ptr fs:[00000030h] 4_2_0175E760
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CF6A mov eax, dword ptr fs:[00000030h] 4_2_0176CF6A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176CF6A mov eax, dword ptr fs:[00000030h] 4_2_0176CF6A
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h] 4_2_017C5F5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h] 4_2_017C5F5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h] 4_2_017C5F5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h] 4_2_017C5F5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h] 4_2_017C5F5F
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_017F1751 mov eax, dword ptr fs:[00000030h] 4_2_017F1751
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0174EF40 mov eax, dword ptr fs:[00000030h] 4_2_0174EF40
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0173A745 mov eax, dword ptr fs:[00000030h] 4_2_0173A745
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Code function: 4_2_0176DF4C mov eax, dword ptr fs:[00000030h] 4_2_0176DF4C
Enables debug privileges
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Memory written: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Process created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior