Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Quotation-4834898943949883.pdf.exe

Overview

General Information

Sample Name:Quotation-4834898943949883.pdf.exe
Analysis ID:383932
MD5:ba34da45fb03afddde208fd6458ac143
SHA1:e132408554f22f314f3e4e151d931de1d3e623e1
SHA256:f7b3ef9d4ac8560bf644a3f3039a32f568563d3299273073abe31fa19ed6470e
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.liveonlinehdplay24.com/kzsw/"], "decoy": ["thelargedoor.com", "newcuus.com", "tgc.xyz", "americanrvwarranties.com", "deroshop.com", "wagyu-importer.com", "frbhomeloan.com", "taniabeautysalonspa.com", "nac-alerton.com", "ordersudsy.com", "villagegardengreeley.com", "locksmithpembrokepines.com", "rafsanjan.net", "jumlasx.xyz", "supermercadoveganmadrid.com", "rubsalmon.com", "glenhelensaturdaymotocross.com", "jichuang888.club", "aajnv.com", "stackablesllc.com", "elevatebuilder.com", "higrandtechnologies.com", "lssqzyg.com", "zjszxs.com", "ssgasiu.com", "brianterrymarketing.com", "nyatiera.com", "elemetasu.com", "larouedesecours.info", "customerye.com", "riotgentler.com", "wwwjeansjewerlys.com", "egyptcon.com", "hona-iq.com", "residsfranchise.com", "flamingogrouprealty.com", "windycitywoodturners.club", "maineguidedfishing.com", "krushirajyafarms.com", "scottsdaledrycleanaz.com", "eisdjsd.asia", "gelgoodplus.com", "numericcarbon.com", "zszq665.com", "researchripples.com", "pravschool.com", "lanshan1688.com", "bashcovid19.com", "enableauth.com", "azbibi.com", "nearyapi.com", "cqshenchi.com", "ipandasz.com", "persero14.com", "lemonadecrystal.com", "sekrema2049.com", "chilternss.com", "bestsgiftstore.com", "vlansi.icu", "namasteyg.com", "msjshelfit.com", "harbee.net", "smiley.team", "sopnosoft.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x92b78:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x92df2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0xbf398:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0xbf612:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9e915:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0xcb135:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x9e401:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0xcac21:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x9ea17:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0xcb237:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x9eb8f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xcb3af:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x9380a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0xc002a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x9d67c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xc9e9c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x94503:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0xc0d23:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0xa4787:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0xd0fa7:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0xa578a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0xa16a9:$sqlite3step: 68 34 1C 7B E1
    • 0xa17bc:$sqlite3step: 68 34 1C 7B E1
    • 0xcdec9:$sqlite3step: 68 34 1C 7B E1
    • 0xcdfdc:$sqlite3step: 68 34 1C 7B E1
    • 0xa16d8:$sqlite3text: 68 38 2A 90 C5
    • 0xa17fd:$sqlite3text: 68 38 2A 90 C5
    • 0xcdef8:$sqlite3text: 68 38 2A 90 C5
    • 0xce01d:$sqlite3text: 68 38 2A 90 C5
    • 0xa16eb:$sqlite3blob: 68 53 D8 7F 8C
    • 0xa1813:$sqlite3blob: 68 53 D8 7F 8C
    • 0xcdf0b:$sqlite3blob: 68 53 D8 7F 8C
    • 0xce033:$sqlite3blob: 68 53 D8 7F 8C
    00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b4f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c4fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 3 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x1b4f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1c4fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x18419:$sqlite3step: 68 34 1C 7B E1
        • 0x1852c:$sqlite3step: 68 34 1C 7B E1
        • 0x18448:$sqlite3text: 68 38 2A 90 C5
        • 0x1856d:$sqlite3text: 68 38 2A 90 C5
        • 0x1845b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x18583:$sqlite3blob: 68 53 D8 7F 8C
        4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1a6f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1b6fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 1 entries

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Antivirus detection for URL or domainShow sources
          Source: www.liveonlinehdplay24.com/kzsw/Avira URL Cloud: Label: malware
          Found malware configurationShow sources
          Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.liveonlinehdplay24.com/kzsw/"], "decoy": ["thelargedoor.com", "newcuus.com", "tgc.xyz", "americanrvwarranties.com", "deroshop.com", "wagyu-importer.com", "frbhomeloan.com", "taniabeautysalonspa.com", "nac-alerton.com", "ordersudsy.com", "villagegardengreeley.com", "locksmithpembrokepines.com", "rafsanjan.net", "jumlasx.xyz", "supermercadoveganmadrid.com", "rubsalmon.com", "glenhelensaturdaymotocross.com", "jichuang888.club", "aajnv.com", "stackablesllc.com", "elevatebuilder.com", "higrandtechnologies.com", "lssqzyg.com", "zjszxs.com", "ssgasiu.com", "brianterrymarketing.com", "nyatiera.com", "elemetasu.com", "larouedesecours.info", "customerye.com", "riotgentler.com", "wwwjeansjewerlys.com", "egyptcon.com", "hona-iq.com", "residsfranchise.com", "flamingogrouprealty.com", "windycitywoodturners.club", "maineguidedfishing.com", "krushirajyafarms.com", "scottsdaledrycleanaz.com", "eisdjsd.asia", "gelgoodplus.com", "numericcarbon.com", "zszq665.com", "researchripples.com", "pravschool.com", "lanshan1688.com", "bashcovid19.com", "enableauth.com", "azbibi.com", "nearyapi.com", "cqshenchi.com", "ipandasz.com", "persero14.com", "lemonadecrystal.com", "sekrema2049.com", "chilternss.com", "bestsgiftstore.com", "vlansi.icu", "namasteyg.com", "msjshelfit.com", "harbee.net", "smiley.team", "sopnosoft.com"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: Quotation-4834898943949883.pdf.exeReversingLabs: Detection: 29%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE
          Machine Learning detection for sampleShow sources
          Source: Quotation-4834898943949883.pdf.exeJoe Sandbox ML: detected
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670713735.0000000001710000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then pop esi
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then pop ebx
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4x nop then pop edi

          Networking:

          barindex
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.liveonlinehdplay24.com/kzsw/
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670815248.0000000002C01000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4
          Source: Quotation-4834898943949883.pdf.exeString found in binary or memory: http://tempuri.org/GridOneHSDataSet.xsd
          Source: Quotation-4834898943949883.pdf.exeString found in binary or memory: http://tempuri.org/HighScoresDataSet.xsd
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comB.TTF
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comm
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.comt
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnate0
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnrig
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.659748125.0000000005CCA000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/$
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/=
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/A
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/B
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/H
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/P
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/n
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Z
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/a-e
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/g
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/A
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/B
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/n
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/u
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670586004.00000000010CB000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: Quotation-4834898943949883.pdf.exe
          Source: initial sampleStatic PE information: Filename: Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6688 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6680 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A060 NtClose,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A110 NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419F30 NtCreateFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419FE0 NtReadFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A05A NtClose,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041A10D NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00419FDB NtCreateFile,NtReadFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017796E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779950 NtQueueApcThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779910 NtAdjustPrivilegesToken,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017799D0 NtCreateProcessEx,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017799A0 NtCreateSection,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177B040 NtSuspendThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779840 NtDelayExecution,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779820 NtEnumerateKey,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017798F0 NtReadVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017798A0 NtWriteVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779B00 NtSetValueKey,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177A3B0 NtGetContextThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779A50 NtCreateFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779A20 NtResumeThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779A10 NtQuerySection,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779A00 NtProtectVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779A80 NtOpenDirectoryObject,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779560 NtWriteFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779540 NtReadFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177AD30 NtSetContextThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779520 NtWaitForSingleObject,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017795F0 NtQueryInformationFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017795D0 NtClose,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177A770 NtOpenThread,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779770 NtSetInformationFile,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779760 NtOpenProcess,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779730 NtQueryVirtualMemory,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779710 NtQueryInformationToken,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177A710 NtOpenProcessToken,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779FE0 NtCreateMutant,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017797A0 NtUnmapViewOfSection,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779780 NtMapViewOfSection,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779670 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779650 NtQueryValueKey,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779610 NtEnumerateValueKey,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_04C80448
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_04C81770
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C5300
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6FC0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1ED8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6FB6
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C2A08
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1A70
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C06B9
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1A80
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C52EF
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C06C8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1ECA
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C8518
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C8508
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C2978
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C29BF
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C11A0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C5598
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1190
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C5588
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C89F8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C89E8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6820
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1810
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C6812
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1800
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C5C78
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1CB1
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C5C88
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C8CE8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C8CD8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C1CC0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00401028
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00401030
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D91B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041E1A8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D21B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041ECBA
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00402D90
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409E40
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409E3B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00402FB0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041E7BA
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173F900
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01752990
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018020A8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A830
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018028EC
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736800
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1002
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180E824
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B090
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01753360
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DCB4F
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175AB40
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F231B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01788BE8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E23E3
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F03DA
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01802B28
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FDBD2
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176ABD8
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176EBB0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175EB9A
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DEB8A
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176138B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018032A9
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018022AE
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017EFA2B
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FE2C5
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01752D50
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01730D20
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018025DD
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01802D07
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174D5E0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01801D55
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017665A0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762581
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FD466
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01752430
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174841F
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180DFCE
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01801FF1
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F67E2
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017BAE60
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01756E30
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FD616
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01755600
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01802EF7
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: String function: 0173B150 appears 154 times
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: String function: 0178D08C appears 40 times
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: String function: 017C5720 appears 78 times
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676889901.0000000008C00000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676251652.0000000007330000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.676714401.0000000008AE0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670058848.00000000009A8000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670586004.00000000010CB000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.671469145.00000000019BF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670473061.0000000000D28000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exeBinary or memory string: OriginalFilenamec.exe4 vs Quotation-4834898943949883.pdf.exe
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.logJump to behavior
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMutant created: \Sessions\1\BaseNamedObjects\dAcuDULllAP
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
          Source: Quotation-4834898943949883.pdf.exeReversingLabs: Detection: 29%
          Source: unknownProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe 'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Quotation-4834898943949883.pdf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wntdll.pdbUGP source: Quotation-4834898943949883.pdf.exe, 00000004.00000002.670713735.0000000001710000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 0_2_073C7408 pushad ; iretd
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041702F push ds; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D0D2 push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D0DB push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_004170F9 push ds; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D085 push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041D13C push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0040F1E9 push ecx; iretd
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00417988 push ebp; iretd
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0040E40C push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0040E421 push ebx; iretd
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00416567 push 0C21EF33h; retf
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041E571 push eax; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0041663D push es; retf
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00416FD9 push ds; ret
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0178D0D1 push ecx; ret
          Source: initial sampleStatic PE information: section name: .text entropy: 7.62426000662

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Uses an obfuscated file name to hide its real file extension (double extension)Show sources
          Source: Possible double extension: pdf.exeStatic PE information: Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion:

          barindex
          Yara detected AntiVM3Show sources
          Source: Yara matchFile source: 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: Quotation-4834898943949883.pdf.exe PID: 7052, type: MEMORY
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409A90 rdtsc
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 7056Thread sleep time: -103486s >= -30000s
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe TID: 7072Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 103486
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeThread delayed: delay time: 922337203685477
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: vmware
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: VMWARE
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
          Source: Quotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_00409A90 rdtsc
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01779860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FE962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173395E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173395E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1951 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180F1B5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180F1B5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01733138 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01754120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018089E7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01740100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01740100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01740100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017331E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C41E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F19D8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176C9BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176C9BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017599BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017661A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017661A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F49A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B69A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764190 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808966 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173519E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173519E mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176A185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FA189 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FA189 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175C182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175F86D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01737057 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01750050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01750050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1843 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764020 mov edi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017340E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01804015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01804015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017358EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017370C0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017370C0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F18CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017620A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017790AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017428AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01733880 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01733880 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01801074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174F370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C6365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01805BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808BB6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01809BBE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017603E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01731BE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175DBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E23E3 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E23E3 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E23E3 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017653C5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1BA8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176B390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01734B94 mov edi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175EB9A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175EB9A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DEB8A mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017DEB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01741B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01741B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017ED380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0177927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017EB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017EB260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01775A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1A5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FEA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C4257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01739240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01738239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01738239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01738239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01734A20 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01734A20 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01774A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01774A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808ADD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01753A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FAA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FAA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01748A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017312D4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01735AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01733ACA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176FAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017612BD mov esi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017612BD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017612BD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01731AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017352A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01765AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01765AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176D294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F129A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176DA88 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176DA88 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01758D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01757D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01774D51 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01774D51 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018005AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_018005AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01773D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E8D47 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B3540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E3D40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173354C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173354C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01743D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FE539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017BA537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01764D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176F527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F3518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017395F0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017395F0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017E8DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017695EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FFDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017EFDD3 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017315C1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01761DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017665A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017635A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01733591 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01762581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F2D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017FB581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01775C70 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017CC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01809CB3 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176A44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01752430 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01752430 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174B433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01763C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01734439 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176BC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F14FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017B6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0180740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808C14 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01732CDB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CCC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01734CB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176D4B0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173649B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173649B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F4496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01731480 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01808C75 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736F60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_01736F60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175E760 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0175E760 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CF6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176CF6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017C5F5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_017F1751 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0174EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0173A745 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeCode function: 4_2_0176DF4C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          Injects a PE file into a foreign processesShow sources
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeMemory written: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe base: 400000 value starts with: 4D5A
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeProcess created: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading11Input Capture1Security Software Discovery221Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information14Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Quotation-4834898943949883.pdf.exe29%ReversingLabsWin32.Trojan.AgentTesla
          Quotation-4834898943949883.pdf.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          4.2.Quotation-4834898943949883.pdf.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.jiyu-kobo.co.jp/jp/A0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/jp/B0%Avira URL Cloudsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/a-e0%Avira URL Cloudsafe
          http://tempuri.org/GridOneHSDataSet.xsd0%Avira URL Cloudsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.fontbureau.comB.TTF0%URL Reputationsafe
          http://www.fontbureau.comB.TTF0%URL Reputationsafe
          http://www.fontbureau.comB.TTF0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y0/n0%Avira URL Cloudsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://tempuri.org/HighScoresDataSet.xsd0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/Z0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Z0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Z0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/H0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/A0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/B0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/=0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/=0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/=0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/u0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/u0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/u0%URL Reputationsafe
          http://www.founder.com.cn/cnate00%Avira URL Cloudsafe
          http://www.fontbureau.comt0%URL Reputationsafe
          http://www.fontbureau.comt0%URL Reputationsafe
          http://www.fontbureau.comt0%URL Reputationsafe
          http://www.fontbureau.comm0%URL Reputationsafe
          http://www.fontbureau.comm0%URL Reputationsafe
          http://www.fontbureau.comm0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/n0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/n0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/n0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/g0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/g0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/g0%URL Reputationsafe
          http://www.founder.com.cn/cnrig0%Avira URL Cloudsafe
          www.liveonlinehdplay24.com/kzsw/100%Avira URL Cloudmalware

          Domains and IPs

          Contacted Domains

          No contacted domains info

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          www.liveonlinehdplay24.com/kzsw/true
          • Avira URL Cloud: malware
          		low

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://www.fontbureau.com/designersGQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
            		high
            http://www.jiyu-kobo.co.jp/jp/AQuotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.jiyu-kobo.co.jp/jp/BQuotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.fontbureau.com/designers/?Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
              		high
              http://www.founder.com.cn/cn/bTheQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.jiyu-kobo.co.jp/a-eQuotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.fontbureau.com/designers?Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                		high
                http://tempuri.org/GridOneHSDataSet.xsdQuotation-4834898943949883.pdf.exefalse
                • Avira URL Cloud: safe
                		unknown
                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name4Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmpfalse
                  		high
                  http://www.tiro.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.fontbureau.com/designersQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                    		high
                    http://www.goodfont.co.krQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssQuotation-4834898943949883.pdf.exe, 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmpfalse
                      		high
                      http://www.sajatypeworks.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.typography.netDQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.founder.com.cn/cn/cTheQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.galapagosdesign.com/staff/dennis.htmQuotation-4834898943949883.pdf.exe, 00000000.00000003.659748125.0000000005CCA000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://fontfabrik.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.comB.TTFQuotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.galapagosdesign.com/DPleaseQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.jiyu-kobo.co.jp/Y0Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fonts.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                        		high
                        http://www.sandoll.co.krQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/Y0/nQuotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.urwpp.deDPleaseQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.jiyu-kobo.co.jp/$Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.zhongyicts.com.cnQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameQuotation-4834898943949883.pdf.exe, 00000000.00000002.670815248.0000000002C01000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000002.670934417.0000000002C9E000.00000004.00000001.sdmpfalse
                          		high
                          http://www.sakkal.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://tempuri.org/HighScoresDataSet.xsdQuotation-4834898943949883.pdf.exefalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/ZQuotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.apache.org/licenses/LICENSE-2.0Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                            		high
                            http://www.fontbureau.comQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                              		high
                              http://www.jiyu-kobo.co.jp/PQuotation-4834898943949883.pdf.exe, 00000000.00000003.657704554.0000000005CCA000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/HQuotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/AQuotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/jp/Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/BQuotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/=Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.comlQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers/cabarga.htmlNQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.founder.com.cn/cnQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-user.htmlQuotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.jiyu-kobo.co.jp/uQuotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.founder.com.cn/cnate0Quotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.comtQuotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.commQuotation-4834898943949883.pdf.exe, 00000000.00000002.675185343.0000000005CCA000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/Quotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmp, Quotation-4834898943949883.pdf.exe, 00000000.00000003.657531967.0000000005CCC000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/nQuotation-4834898943949883.pdf.exe, 00000000.00000003.656963455.0000000005CCC000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers8Quotation-4834898943949883.pdf.exe, 00000000.00000002.675247066.0000000005DB0000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.jiyu-kobo.co.jp/gQuotation-4834898943949883.pdf.exe, 00000000.00000003.657411914.0000000005CCC000.00000004.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cnrigQuotation-4834898943949883.pdf.exe, 00000000.00000003.655212335.0000000005CCE000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown

                                    Contacted IPs

                                    No contacted IP infos

                                    General Information

                                    Joe Sandbox Version:31.0.0 Emerald
                                    Analysis ID:383932
                                    Start date:08.04.2021
                                    Start time:12:41:32
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 6m 6s
                                    Hypervisor based Inspection enabled:false
                                    Report type:light
                                    Sample file name:Quotation-4834898943949883.pdf.exe
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:6
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Detection:MAL
                                    Classification:mal100.troj.evad.winEXE@3/1@0/0
                                    EGA Information:Failed
                                    HDC Information:
                                    • Successful, ratio: 5.2% (good quality ratio 5%)
                                    • Quality average: 80%
                                    • Quality standard deviation: 24.7%
                                    HCA Information:
                                    • Successful, ratio: 90%
                                    • Number of executed functions: 0
                                    • Number of non-executed functions: 0
                                    Cookbook Comments:
                                    • Adjust boot time
                                    • Enable AMSI
                                    • Found application associated with file extension: .exe
                                    • Stop behavior analysis, all processes terminated
                                    Warnings:
                                    Show All
                                    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe
                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                    • VT rate limit hit for: /opt/package/joesandbox/database/analysis/383932/sample/Quotation-4834898943949883.pdf.exe

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    12:42:28API Interceptor1x Sleep call for process: Quotation-4834898943949883.pdf.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    No context

                                    Domains

                                    No context

                                    ASN

                                    No context

                                    JA3 Fingerprints

                                    No context

                                    Dropped Files

                                    No context

                                    Created / dropped Files

                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation-4834898943949883.pdf.exe.log
                                    Process:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                    File Type:ASCII text, with CRLF line terminators
                                    Category:dropped
                                    Size (bytes):1314
                                    Entropy (8bit):5.350128552078965
                                    Encrypted:false
                                    SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                    MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                    SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                    SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                    SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                    Malicious:true
                                    Reputation:high, very likely benign file
                                    Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                    Static File Info

                                    General

                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                    Entropy (8bit):7.602799015135587
                                    TrID:
                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                    • Win32 Executable (generic) a (10002005/4) 49.75%
                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                    • Windows Screen Saver (13104/52) 0.07%
                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                    File name:Quotation-4834898943949883.pdf.exe
                                    File size:692224
                                    MD5:ba34da45fb03afddde208fd6458ac143
                                    SHA1:e132408554f22f314f3e4e151d931de1d3e623e1
                                    SHA256:f7b3ef9d4ac8560bf644a3f3039a32f568563d3299273073abe31fa19ed6470e
                                    SHA512:07ae60dcbedb260e1de1cea8a3b876f5a39161e0498b2c59e3ccc24bdb814f08a0986fd606fc4e8190c6a066147c2b07fd3e385b49952db95fb1116399498717
                                    SSDEEP:12288:P55tWbm6iLEPkfJNl0+AcMISr1vpnVvCVBvG1iuR/+Bf/f:P55UTiWkfJc+L6pvrCVB2an
                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....zn`..............P..J...D......rd... ........@.. ....................................@................................

                                    File Icon

                                    Icon Hash:2b014c5a4a450127

                                    Static PE Info

                                    General

                                    Entrypoint:0x4a6472
                                    Entrypoint Section:.text
                                    Digitally signed:false
                                    Imagebase:0x400000
                                    Subsystem:windows gui
                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                    DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                    Time Stamp:0x606E7ACC [Thu Apr 8 03:38:52 2021 UTC]
                                    TLS Callbacks:
                                    CLR (.Net) Version:v4.0.30319
                                    OS Version Major:4
                                    OS Version Minor:0
                                    File Version Major:4
                                    File Version Minor:0
                                    Subsystem Version Major:4
                                    Subsystem Version Minor:0
                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                    Entrypoint Preview

                                    Instruction
                                    jmp dword ptr [00402000h]
                                    add dword ptr [eax], eax
                                    add byte ptr [eax], al
                                    add al, byte ptr [eax]
                                    add byte ptr [eax], al
                                    or byte ptr [eax], al
                                    add byte ptr [eax], al
                                    or eax, 0C000000h
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], al
                                    add byte ptr [eax], al
                                    pop es
                                    add byte ptr [eax], al
                                    add byte ptr [esi], al
                                    add byte ptr [eax], al
                                    add byte ptr [edx], cl
                                    add byte ptr [eax], al
                                    add byte ptr [esi], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], cl
                                    add byte ptr [eax], al
                                    push cs
                                    add byte ptr [eax], al
                                    add byte ptr [esi], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [esi], cl
                                    add byte ptr [eax], al
                                    add byte ptr [ecx], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax], cl
                                    add byte ptr [eax], al
                                    add byte ptr [ebx], al
                                    add byte ptr [eax], al
                                    add byte ptr [esi], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], al
                                    add byte ptr [eax], al
                                    pop es
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add al, byte ptr [eax]
                                    add byte ptr [eax], al
                                    push es
                                    add byte ptr [eax], al
                                    add byte ptr [edx], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], al
                                    add byte ptr [eax], al
                                    or al, byte ptr [eax]
                                    add byte ptr [eax], al
                                    push cs
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax], al
                                    add byte ptr [ecx], cl
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], cl
                                    add byte ptr [eax], al
                                    add eax, 00000000h
                                    add byte ptr [eax], al
                                    add byte ptr [ebx], al
                                    add byte ptr [eax], al
                                    add byte ptr [eax+eax], al
                                    add byte ptr [eax], al
                                    or eax, dword ptr [eax]
                                    add byte ptr [eax], al
                                    or eax, dword ptr [eax]
                                    add byte ptr [eax], al
                                    or al, 00h
                                    add byte ptr [eax], al
                                    or eax, 02000000h
                                    add byte ptr [eax], al
                                    add byte ptr [ecx], al
                                    add byte ptr [eax], al
                                    add byte ptr [edx], al
                                    add byte ptr [eax], al
                                    add byte ptr [esi], cl
                                    add byte ptr [eax], al
                                    add byte ptr [00000000h], al

                                    Data Directories

                                    NameVirtual AddressVirtual Size Is in Section
                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xa64200x4f.text
                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xa80000x4160.rsrc
                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0xae0000xc.reloc
                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                    Sections

                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                    .text0x20000xa49a80xa4a00False0.785208155372data7.62426000662IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                    .rsrc0xa80000x41600x4200False0.221117424242data4.49408146936IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                    .reloc0xae0000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                    Resources

                                    NameRVASizeTypeLanguageCountry
                                    RT_ICON0xa81900x468GLS_BINARY_LSB_FIRST
                                    RT_ICON0xa85f80x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295
                                    RT_ICON0xa96a00x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295
                                    RT_GROUP_ICON0xabc480x30data
                                    RT_VERSION0xabc780x2fcdata
                                    RT_MANIFEST0xabf740x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                    Imports

                                    DLLImport
                                    mscoree.dll_CorExeMain

                                    Version Infos

                                    DescriptionData
                                    Translation0x0000 0x04b0
                                    LegalCopyrightCopyright 2015
                                    Assembly Version1.0.0.0
                                    InternalNamec.exe
                                    FileVersion1.0.0.0
                                    CompanyName
                                    LegalTrademarks
                                    Comments
                                    ProductNameCodewords
                                    ProductVersion1.0.0.0
                                    FileDescriptionCodewords
                                    OriginalFilenamec.exe

                                    Network Behavior

                                    No network behavior found

                                    Code Manipulations

                                    Statistics

                                    Behavior

                                    Click to jump to process

                                    System Behavior

                                    Analysis Process: Quotation-4834898943949883.pdf.exe PID: 7052 Parent PID: 4180

                                    General

                                    Start time:12:42:21
                                    Start date:08/04/2021
                                    Path:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                    Wow64 process (32bit):true
                                    Commandline:'C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe'
                                    Imagebase:0x900000
                                    File size:692224 bytes
                                    MD5 hash:BA34DA45FB03AFDDDE208FD6458AC143
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:.Net C# or VB.NET
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.672325771.0000000003CCC000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.670882860.0000000002C57000.00000004.00000001.sdmp, Author: Joe Security
                                    Reputation:low

                                    Analysis Process: Quotation-4834898943949883.pdf.exe PID: 5888 Parent PID: 7052

                                    General

                                    Start time:12:42:30
                                    Start date:08/04/2021
                                    Path:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                    Wow64 process (32bit):true
                                    Commandline:C:\Users\user\Desktop\Quotation-4834898943949883.pdf.exe
                                    Imagebase:0xc80000
                                    File size:692224 bytes
                                    MD5 hash:BA34DA45FB03AFDDDE208FD6458AC143
                                    Has elevated privileges:true
                                    Has administrator privileges:true
                                    Programmed in:C, C++ or other language
                                    Yara matches:
                                    • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                    • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                    • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.670284785.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                    Reputation:low

                                    Disassembly

                                    Code Analysis

                                    Reset < >