Loading ...

Play interactive tourEdit tour

Analysis Report Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe

Overview

General Information

Sample Name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
Analysis ID:433045
MD5:7792ed45165589f6518121b7015dc516
SHA1:c0ce682e0f3561e3a7540c15e5cc08e69c0ab53a
SHA256:2dbc1e319c840368cea5d83819feafbfaec855e245438e8e50105c464c422953
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code contains very large strings
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 5 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeVirustotal: Detection: 40%Perma Link
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeMetadefender: Detection: 17%Perma Link
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeReversingLabs: Detection: 32%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeVirustotal: Detection: 32%Perma Link
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMetadefender: Detection: 17%Perma Link
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeReversingLabs: Detection: 32%
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://kqfOpU.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303002904.000000000110B000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      .NET source code contains very large stringsShow sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.2.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.1.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DE6900_2_013DE690
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DC2340_2_013DC234
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DE6820_2_013DE682
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03D600_2_04D03D60
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D030C00_2_04D030C0
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D000400_2_04D00040
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03D500_2_04D03D50
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D005200_2_04D00520
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03FC80_2_04D03FC8
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03FB90_2_04D03FB9
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D030B70_2_04D030B7
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D000070_2_04D00007
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D041AD0_2_04D041AD
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03A700_2_04D03A70
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03A610_2_04D03A61
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D02A100_2_04D02A10
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D02A000_2_04D02A00
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E47B319_2_032E47B3
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E482719_2_032E4827
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032ED88019_2_032ED880
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.316834328.00000000076E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.317584678.000000000D420000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWindowsNetwork.dll> vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303002904.000000000110B000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000012.00000000.299366791.000000000016C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000000.300836805.0000000000F3C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: XzPoCGKinsp.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@8/3@0/0
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_01
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMutant created: \Sessions\1\BaseNamedObjects\TGVQnnhcxn
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Local\Temp\tmpDAD0.tmpJump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeVirustotal: Detection: 32%
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMetadefender: Detection: 17%
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeReversingLabs: Detection: 32%
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile read: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe 'C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains method to dynamically call methods (often used by packers)Show sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.2.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.1.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D04B41 push esi; retf 0_2_04D04B43
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D04B37 push esi; retf 0_2_04D04B39
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_052BED30 pushfd ; ret 0_2_052BED31
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E5525 push ss; iretd 19_2_032E5529
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.69660468542
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.69660468542
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exeJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exeJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exeJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWindow / User API: threadDelayed 1665Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWindow / User API: threadDelayed 8189Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5644Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 2000Thread sleep time: -12912720851596678s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5024Thread sleep count: 1665 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5024Thread sleep count: 8189 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMemory written: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}Jump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}Jump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading1Input Capture1Security Software Discovery321Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion141Security Account ManagerVirtualization/Sandbox Evasion141SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsSystem Information Discovery113VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe33%VirustotalBrowse
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe20%MetadefenderBrowse
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe33%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe41%VirustotalBrowse
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe20%MetadefenderBrowse
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe33%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                      19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://kqfOpU.com0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      low
                      http://www.apache.org/licenses/LICENSE-2.0Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                        high
                        http://www.fontbureau.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                          high
                          http://www.fontbureau.com/designersGRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                            high
                            http://DynDns.comDynDNSRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            unknown
                            http://www.fontbureau.com/designers/?Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                              high
                              http://www.founder.com.cn/cn/bTheRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              http://www.fontbureau.com/designers?Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                high
                                http://www.tiro.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                unknown
                                http://www.fontbureau.com/designersRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  high
                                  http://www.goodfont.co.krRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.carterandcone.comlRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.sajatypeworks.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.typography.netDRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    high
                                    http://www.founder.com.cn/cn/cTheRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://fontfabrik.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.founder.com.cn/cnRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      high
                                      http://www.jiyu-kobo.co.jp/Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.galapagosdesign.com/DPleaseRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      unknown
                                      http://www.fontbureau.com/designers8Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                        high
                                        http://www.fonts.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          high
                                          http://www.sandoll.co.krRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.urwpp.deDPleaseRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://www.zhongyicts.com.cnRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          unknown
                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpfalse
                                            high
                                            http://www.sakkal.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            http://kqfOpU.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown

                                            Contacted IPs

                                            No contacted IP infos

                                            General Information

                                            Joe Sandbox Version:32.0.0 Black Diamond
                                            Analysis ID:433045
                                            Start date:11.06.2021
                                            Start time:08:12:19
                                            Joe Sandbox Product:CloudBasic
                                            Overall analysis duration:0h 8m 51s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Sample file name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                            Number of analysed new started processes analysed:29
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • HDC enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Detection:MAL
                                            Classification:mal100.troj.evad.winEXE@8/3@0/0
                                            EGA Information:Failed
                                            HDC Information:Failed
                                            HCA Information:
                                            • Successful, ratio: 100%
                                            • Number of executed functions: 56
                                            • Number of non-executed functions: 9
                                            Cookbook Comments:
                                            • Adjust boot time
                                            • Enable AMSI
                                            • Found application associated with file extension: .exe
                                            Warnings:
                                            Show All
                                            • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            08:14:07API Interceptor509x Sleep call for process: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            No context

                                            Domains

                                            No context

                                            ASN

                                            No context

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.log
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:true
                                            Reputation:high, very likely benign file
                                            Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                            C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1644
                                            Entropy (8bit):5.191913760884606
                                            Encrypted:false
                                            SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBvhPtn:cbh47TlNQ//rydbz9I3YODOLNdq31
                                            MD5:CCF95DC96B7BD87A01055032CE0CD57A
                                            SHA1:10B8216829D3DD59A64A4A5F7ABB344501A79201
                                            SHA-256:75F1F589EC1E5F1837421327A67518EBE99E02FFD7A2B2C3BCD92565A87ACE28
                                            SHA-512:9C109BEB3F234467F39BE0A9A77C8D3C44434744EC17B46E22203D7E73E6D66C1CD0F97892DAD97E47E9AA15FC5223892A0C87AE9AF3CF1CAB7488E9C06396AA
                                            Malicious:true
                                            Reputation:low
                                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                            C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Category:dropped
                                            Size (bytes):499712
                                            Entropy (8bit):7.663532105306135
                                            Encrypted:false
                                            SSDEEP:12288:jzuwEDaodkRgQbC89xGaFhod8iP+sW+W:jzu3eEkRgqCyaqurW+
                                            MD5:7792ED45165589F6518121B7015DC516
                                            SHA1:C0CE682E0F3561E3A7540C15E5CC08E69C0AB53A
                                            SHA-256:2DBC1E319C840368CEA5D83819FEAFBFAEC855E245438E8E50105C464C422953
                                            SHA-512:9D0DFAE32CADDDA0B33708160361E794A1DE1ED483BC62817AC0800B3969BA404E3495B7CA07D87AD678BE0E45AF5628C0F2F67773FA851EBDA20FABFB65EEFB
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Virustotal, Detection: 41%, Browse
                                            • Antivirus: Metadefender, Detection: 20%, Browse
                                            • Antivirus: ReversingLabs, Detection: 33%
                                            Reputation:low
                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{Y.`..............0.................. ........@.. ....................................@.....................................O.......\............................................................................ ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B.......................H.......@...........?....w...0..........................................^.(........}......}....*.0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+...*..0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p( .....,..o....

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Entropy (8bit):7.663532105306135
                                            TrID:
                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                            • Win32 Executable (generic) a (10002005/4) 49.75%
                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                            • Windows Screen Saver (13104/52) 0.07%
                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                            File name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File size:499712
                                            MD5:7792ed45165589f6518121b7015dc516
                                            SHA1:c0ce682e0f3561e3a7540c15e5cc08e69c0ab53a
                                            SHA256:2dbc1e319c840368cea5d83819feafbfaec855e245438e8e50105c464c422953
                                            SHA512:9d0dfae32caddda0b33708160361e794a1de1ed483bc62817ac0800b3969ba404e3495b7ca07d87ad678be0e45af5628c0f2f67773fa851ebda20fabfb65eefb
                                            SSDEEP:12288:jzuwEDaodkRgQbC89xGaFhod8iP+sW+W:jzu3eEkRgqCyaqurW+
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{Y.`..............0.................. ........@.. ....................................@................................

                                            File Icon

                                            Icon Hash:18da1abcb2d2d2b0

                                            Static PE Info

                                            General

                                            Entrypoint:0x47a80a
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                            Time Stamp:0x60C2597B [Thu Jun 10 18:27:07 2021 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:v4.0.30319
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                            Entrypoint Preview

                                            Instruction
                                            jmp dword ptr [00402000h]
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x7a7b80x4f.text
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x7c0000x105c.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x7e0000xc.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x20000x788100x78a00False0.867159164508data7.69660468542IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                            .rsrc0x7c0000x105c0x1200False0.270399305556data2.85309442637IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x7e0000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_ICON0x7c1000x8a8dBase III DBT, version number 0, next free block index 40
                                            RT_GROUP_ICON0x7c9b80x14data
                                            RT_VERSION0x7c9dc0x480data
                                            RT_MANIFEST0x7ce6c0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                            Imports

                                            DLLImport
                                            mscoree.dll_CorExeMain

                                            Version Infos

                                            DescriptionData
                                            Translation0x0000 0x04b0
                                            LegalCopyrightDecember 19th, 2006
                                            Assembly Version1.0.7.8
                                            InternalNameUHLv.exe
                                            FileVersion1.0.7.8
                                            CompanyNameCoded by James O'Cull
                                            LegalTrademarks
                                            CommentsContact management is a solution for anyone who needs to be able to access their list of contacts from removable media without any installation.
                                            ProductNameContact Management
                                            ProductVersion1.0.7.8
                                            FileDescriptionContact Management
                                            OriginalFilenameUHLv.exe

                                            Network Behavior

                                            No network behavior found

                                            Code Manipulations

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Start time:08:13:11
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe'
                                            Imagebase:0x9c0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            General

                                            Start time:08:13:52
                                            Start date:11/06/2021
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                                            Imagebase:0xa60000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Start time:08:13:52
                                            Start date:11/06/2021
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff6b2800000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Start time:08:13:53
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):false
                                            Commandline:{path}
                                            Imagebase:0xf0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low

                                            General

                                            Start time:08:13:53
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):true
                                            Commandline:{path}
                                            Imagebase:0xec0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Disassembly

                                            Code Analysis

                                            Reset < >

                                              Executed Functions

                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID: ;i
                                              • API String ID: 0-1857932019
                                              • Opcode ID: 865d84468d866055468c54b5682e31edccab6b3268e84a7df3a9148ed5e6445f
                                              • Instruction ID: d1881057e6b9e08a44a6092afcc4e1fc5922fd248402ae38cc823fc36c250bc1
                                              • Opcode Fuzzy Hash: 865d84468d866055468c54b5682e31edccab6b3268e84a7df3a9148ed5e6445f
                                              • Instruction Fuzzy Hash: C2514870E1A209DBCB04CFA9E5807EDFBB6BF89300F10D52AE905B7284E774A9419B14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID: ;i
                                              • API String ID: 0-1857932019
                                              • Opcode ID: 52708d055fd6f28c2942345dc5e105ace7bc1268c72b2531da297879bf385759
                                              • Instruction ID: 010b1b35058df9c9583dc021094537bd7634b254ab9b145bff7fef01888272f5
                                              • Opcode Fuzzy Hash: 52708d055fd6f28c2942345dc5e105ace7bc1268c72b2531da297879bf385759
                                              • Instruction Fuzzy Hash: 5F514874E16209DFCB04CFA9E5807EDFBB2BF89310F10952AE805F7284E774A9419B24
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f481087705eb62fd1dd9cc2ddb4e4aa6f2924b9ef3a7dd1d7c46af25263d7857
                                              • Instruction ID: 93ab7f99e976b0e5742bbf67e29ed3393d4dcbb188fe8f1fb24e6598d359ccb9
                                              • Opcode Fuzzy Hash: f481087705eb62fd1dd9cc2ddb4e4aa6f2924b9ef3a7dd1d7c46af25263d7857
                                              • Instruction Fuzzy Hash: 5912B4F14117468BE734EF65E9981893BB1BB85328F904308D2616FAF9D7B8114BEF84
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 8068c881638685cda0eaf7973635f2e2a3a2dcdbe7e7dff63fed6e5a8a523ba0
                                              • Instruction ID: 8e02f109500d4f95aeeb26a0c532825802bc5e5cd43c0fe2ed6d8200f9d55456
                                              • Opcode Fuzzy Hash: 8068c881638685cda0eaf7973635f2e2a3a2dcdbe7e7dff63fed6e5a8a523ba0
                                              • Instruction Fuzzy Hash: A4B16870E092499FCB09CFE9D5446DEBBF2BF89304F14C56AD444EB295E734AA02CB61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 27ce8854a19629aa4e18351212fd449ac0486a0291c7182f0acdaf4bb7d0e68b
                                              • Instruction ID: 107a72a385638417a8fbdb0175ac21130ad3b5d59d8189e5d8ab5a51e2134a28
                                              • Opcode Fuzzy Hash: 27ce8854a19629aa4e18351212fd449ac0486a0291c7182f0acdaf4bb7d0e68b
                                              • Instruction Fuzzy Hash: 21B14570E052199FCB08CFE9D9446DEFBF2BF89304F14C529D458AB354E734AA428B61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 20e18482bc7d38983855ac04624eb7ba2c351b905316483a3e0f8ced78de450a
                                              • Instruction ID: a33087932a09097ddf6c7697861732034e87c874f2cf94573d8c23ed18106815
                                              • Opcode Fuzzy Hash: 20e18482bc7d38983855ac04624eb7ba2c351b905316483a3e0f8ced78de450a
                                              • Instruction Fuzzy Hash: 7BC118F18117468BD724EF65E8982897BB1FB85328F514308D2616FAF8D7B8114BEF84
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 0f46c3890af28a552a1de315848cbb00132d08cea7da2a8d7a8267c021a3ddb4
                                              • Instruction ID: 10133f3dbad1a47cd332fdd3a67818288d57553b466242f5d860840a284f0a06
                                              • Opcode Fuzzy Hash: 0f46c3890af28a552a1de315848cbb00132d08cea7da2a8d7a8267c021a3ddb4
                                              • Instruction Fuzzy Hash: A371F474E152199FDB14DFA5D884A9EBBB2FF88300F14C42AE816AB358EB345941DF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 51574a2792a3007b79533080f172aa6c5ce0c0b84541420e5e64d72a536c915e
                                              • Instruction ID: b557f8e2853c6c2a3b33d107d49c668f29c92b7023a432a8e1d31c5420011636
                                              • Opcode Fuzzy Hash: 51574a2792a3007b79533080f172aa6c5ce0c0b84541420e5e64d72a536c915e
                                              • Instruction Fuzzy Hash: F471E474E15219DFDB14DFA5D884A9EBBB2FF88300F14C42AE80AAB354EB345941DF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04D05723
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: CreateProcess
                                              • String ID:
                                              • API String ID: 963392458-0
                                              • Opcode ID: 750bc0a71019372b4c5c2b97451bbee72dee99d113d608e6bd9b5ae77657bc58
                                              • Instruction ID: 9a4a6546fee3791d853e3a02b41add707111da8b2584d1b6279812cd150a0c7a
                                              • Opcode Fuzzy Hash: 750bc0a71019372b4c5c2b97451bbee72dee99d113d608e6bd9b5ae77657bc58
                                              • Instruction Fuzzy Hash: 6F510A71D00319DFDB60CF99D880BDEBBB5BF88314F1484A9E808A7250DB75AA89DF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04D05723
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: CreateProcess
                                              • String ID:
                                              • API String ID: 963392458-0
                                              • Opcode ID: f4e9063d50a96d9ad9a080e877ecc041aab191f4277762bf3e81a849875b15bc
                                              • Instruction ID: 872a0aad8b55f1fa245bcfa68fb62ef4a91c5f6fa87964174c8295ca6a328058
                                              • Opcode Fuzzy Hash: f4e9063d50a96d9ad9a080e877ecc041aab191f4277762bf3e81a849875b15bc
                                              • Instruction Fuzzy Hash: 8751F871D00319DFDB60CF99D880BDEBBB5BF88314F1584A9E808A7250DB75AA88DF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013DFF2A
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: e3081cbaa023ebe0456c606451ae67ea6d32159cdaa21009ed4e3353d377589a
                                              • Instruction ID: b6ae0fdc0fff97350192092bdc362477ad435a8c725293b168cd295bfe486910
                                              • Opcode Fuzzy Hash: e3081cbaa023ebe0456c606451ae67ea6d32159cdaa21009ed4e3353d377589a
                                              • Instruction Fuzzy Hash: 4851D0B1D002099FDB14CFA9D884ADEBFF5BF88314F24852AE819AB210D7749946CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 013DFF2A
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: a8e55690b4ed5dead58e7d6c512acd3d8e5400de7e2be0596ea19f9107ab3f70
                                              • Instruction ID: 39bc3253b2334c428858e29ed3a677a84bf180dee669763802287561efe0318f
                                              • Opcode Fuzzy Hash: a8e55690b4ed5dead58e7d6c512acd3d8e5400de7e2be0596ea19f9107ab3f70
                                              • Instruction Fuzzy Hash: 2451A0B1D103199FDB14CFAAD884ADEFBF5BF48314F24852AE819AB210D7749945CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateActCtxA.KERNEL32(?), ref: 013D5421
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: Create
                                              • String ID:
                                              • API String ID: 2289755597-0
                                              • Opcode ID: 90d67e62a4ce5f40975bf924c0b6fae143e07a53bb305f022ccc6d5766b3e66a
                                              • Instruction ID: 3d47638d2c8f34c01238bca03f5a5b7cc5e47fe36d4417eac490ef348c2dd8f9
                                              • Opcode Fuzzy Hash: 90d67e62a4ce5f40975bf924c0b6fae143e07a53bb305f022ccc6d5766b3e66a
                                              • Instruction Fuzzy Hash: 6A41F1B1D00619CFDB24DFAAD8847CEBBB5BF48308F108069D509BB251DB756949CF91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateActCtxA.KERNEL32(?), ref: 013D5421
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: Create
                                              • String ID:
                                              • API String ID: 2289755597-0
                                              • Opcode ID: a02ecb4eab7a63999ec23e3505e811c74fd81c9d718386dbfec91419a2621b57
                                              • Instruction ID: efea866369c7c15842b80643e0ce4aa46b24e2a07dc71a6178f33d160b08bbf5
                                              • Opcode Fuzzy Hash: a02ecb4eab7a63999ec23e3505e811c74fd81c9d718386dbfec91419a2621b57
                                              • Instruction Fuzzy Hash: F34112B1D00619CFDB24CFA9D8857CEBBB5BF48309F20806AD108BB251DB75694ACF91
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 052B2501
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.312690528.00000000052B0000.00000040.00000001.sdmp, Offset: 052B0000, based on PE: false
                                              Similarity
                                              • API ID: CallProcWindow
                                              • String ID:
                                              • API String ID: 2714655100-0
                                              • Opcode ID: 135241f382b417f314a64d07520b612b2afa60aa0cf09a1f490037fe1485b3bd
                                              • Instruction ID: 9396db9ff8e52727220e75318aede78331f334dcdf6b77ab97f77cbaf9174911
                                              • Opcode Fuzzy Hash: 135241f382b417f314a64d07520b612b2afa60aa0cf09a1f490037fe1485b3bd
                                              • Instruction Fuzzy Hash: EB4138B8A10305CFDB14CF99C448BAABBF6FF88314F158499D419AB321D774A941CFA0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D05D1D
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessWrite
                                              • String ID:
                                              • API String ID: 3559483778-0
                                              • Opcode ID: 66a573bd7170858fcbf8bf3cbd520baca8691829b82ac0fd7d93206d67165a12
                                              • Instruction ID: 7a77dfb499e6996fd1405309b90e9067a72e0e9f4ec80f571583bcc4577970da
                                              • Opcode Fuzzy Hash: 66a573bd7170858fcbf8bf3cbd520baca8691829b82ac0fd7d93206d67165a12
                                              • Instruction Fuzzy Hash: C32103B1900259AFDB10CF9AD885BDEBBF4FF48310F04842AE919A7340D778A954CFA5
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,013DB99E,?,?,?,?,?), ref: 013DBA5F
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: d2535013a6876c328f0169fb6b544958ac30965c1de039c9ee9625f0d1592a3a
                                              • Instruction ID: 583170660ff24b0b2fa84c8633dd83146e65a71256b275fbdeb2953b3306e846
                                              • Opcode Fuzzy Hash: d2535013a6876c328f0169fb6b544958ac30965c1de039c9ee9625f0d1592a3a
                                              • Instruction Fuzzy Hash: F121E5B5900248DFDB10CF9AD484ADEFBF4EB49314F15841AE914A7310D374A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04D05D1D
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessWrite
                                              • String ID:
                                              • API String ID: 3559483778-0
                                              • Opcode ID: e3d3e7fed07ac1f9b7108f8346c186ba4a67a6f4cf2db18742fe792f8a151625
                                              • Instruction ID: d813199064a759c08b38f18191d33f1357d23aaa6601d840e4c1912d54daddaf
                                              • Opcode Fuzzy Hash: e3d3e7fed07ac1f9b7108f8346c186ba4a67a6f4cf2db18742fe792f8a151625
                                              • Instruction Fuzzy Hash: A82100B19002599FCB10CF9AD885BDEBBF4FB48310F00842AE918A3240D778A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 013D96F6
                                                • Part of subcall function 013D8820: LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013D9771,00000800,00000000,00000000), ref: 013D9982
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: HandleLibraryLoadModule
                                              • String ID:
                                              • API String ID: 4133054770-0
                                              • Opcode ID: c9be528d7e2a73b8bbecbe337ea8bf0fc9e9825dfda7a170e71e5c152a8c2325
                                              • Instruction ID: eac196ed136a4b24d9321d53a4d82ca60cae51c813499c38799b8e0d33ebf760
                                              • Opcode Fuzzy Hash: c9be528d7e2a73b8bbecbe337ea8bf0fc9e9825dfda7a170e71e5c152a8c2325
                                              • Instruction Fuzzy Hash: 3111E273A042448FDB10DFAAF8447AABBF9AFC5328F05845AD555E3252C634A806CB61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,013DB99E,?,?,?,?,?), ref: 013DBA5F
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: 1c109d0a0cc9230a54b4604606a7c61cd1a63f03affc39e7b22b9c4b7637ea90
                                              • Instruction ID: 0d4546bfc33c6fd5918a3fd3236e58b1d60dc729947c293e5dc790e46107b00d
                                              • Opcode Fuzzy Hash: 1c109d0a0cc9230a54b4604606a7c61cd1a63f03affc39e7b22b9c4b7637ea90
                                              • Instruction Fuzzy Hash: 4321E0B6900209DFDB00CFA9D985ADEFBF4FB48324F15841AE914A3310D378A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04D05A7F
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessRead
                                              • String ID:
                                              • API String ID: 1726664587-0
                                              • Opcode ID: 20f1b05166aabf3d17333769347ff7d3666c0e02e7915de281aa7af3165b7c84
                                              • Instruction ID: cf222cd25276e05fce24294f53bbd47ba5c10b0c2b5c60300faee4a215a2bbad
                                              • Opcode Fuzzy Hash: 20f1b05166aabf3d17333769347ff7d3666c0e02e7915de281aa7af3165b7c84
                                              • Instruction Fuzzy Hash: E221EFB5D012599FCB10CF9AD985BDEBBF4BF48310F04842AE918A7250D338A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04D05A7F
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MemoryProcessRead
                                              • String ID:
                                              • API String ID: 1726664587-0
                                              • Opcode ID: 1d8178ca3a2b6fdfc197ac6573de84aa0480ccbcf1def78db909b6dd2c0b9a08
                                              • Instruction ID: bd153f6f8a102ad756dbfb446d281c360f6fa370a071be6f997eecdbe51c3626
                                              • Opcode Fuzzy Hash: 1d8178ca3a2b6fdfc197ac6573de84aa0480ccbcf1def78db909b6dd2c0b9a08
                                              • Instruction Fuzzy Hash: 9521DEB19012599FCB10CF9AD884BDEFBF4FB48320F14842AE918A7250D378A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • SetThreadContext.KERNELBASE(?,00000000), ref: 04D059B7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: ContextThread
                                              • String ID:
                                              • API String ID: 1591575202-0
                                              • Opcode ID: 29969424a0d48396a06d8676feeb331ea4a0d9352ab8d8cdf99c1932f08f9852
                                              • Instruction ID: 24da6a29135484da7b64cc57df254022746736c5046ab846320f0735c9bf4897
                                              • Opcode Fuzzy Hash: 29969424a0d48396a06d8676feeb331ea4a0d9352ab8d8cdf99c1932f08f9852
                                              • Instruction Fuzzy Hash: 452106B1D006199FDB00CF9AD9857DEFBF4BB49224F44812AD818B3340D778A9548FA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • SetThreadContext.KERNELBASE(?,00000000), ref: 04D059B7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: ContextThread
                                              • String ID:
                                              • API String ID: 1591575202-0
                                              • Opcode ID: 663645faef67c80f48c9a585a4633818f783c8dac6a162eb808b1e478e9cbdcb
                                              • Instruction ID: 0f41eca539c4380312a48922624ba677fad02dc57017046a4208a4c832b358bf
                                              • Opcode Fuzzy Hash: 663645faef67c80f48c9a585a4633818f783c8dac6a162eb808b1e478e9cbdcb
                                              • Instruction Fuzzy Hash: 342138B1D0061A9FDB00CF9AD5457DEFBF4BB09220F04852AD418B3741D778A9548FA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013D9771,00000800,00000000,00000000), ref: 013D9982
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: f4bf44c64003a427eac569512a12343fb86857d197093ef3d16a8ae70174f391
                                              • Instruction ID: d7d20f7bda377a42afb9a516115022986941ecc7a061cd4799f1b50371b8a0c0
                                              • Opcode Fuzzy Hash: f4bf44c64003a427eac569512a12343fb86857d197093ef3d16a8ae70174f391
                                              • Instruction Fuzzy Hash: 9A11E4B69002499FDB10CF9AD444BDEFBF8EB88318F14842ED519B7610C775A945CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,013D9771,00000800,00000000,00000000), ref: 013D9982
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: LibraryLoad
                                              • String ID:
                                              • API String ID: 1029625771-0
                                              • Opcode ID: 1aeed9731deb5c3c5e791b5a99bdf7b1b675c0e3743ebc9fdd4dc1a710e5400a
                                              • Instruction ID: d4338618ec60dbc195c83b8780bc95945ae186b8209947920b4bf7fd3648baed
                                              • Opcode Fuzzy Hash: 1aeed9731deb5c3c5e791b5a99bdf7b1b675c0e3743ebc9fdd4dc1a710e5400a
                                              • Instruction Fuzzy Hash: 831114B69003499FDB10CF9AD444BDEFBF8EB88314F04841AD559A7200C775A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • PostMessageW.USER32(?,?,?,?), ref: 04D067A5
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: 320b92010df44f9bb85b366b5ab0e7e9f442c1e06b46d8cd0434ce00a60a1453
                                              • Instruction ID: adca715caff8fbc6fba6d0f0fbfba26ffb145f7cc075ec714718d39a30803547
                                              • Opcode Fuzzy Hash: 320b92010df44f9bb85b366b5ab0e7e9f442c1e06b46d8cd0434ce00a60a1453
                                              • Instruction Fuzzy Hash: 6E11F2B59002499FDB10CF9AD889BDEFBF8EB88324F10841AE954A7640C374A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 013D96F6
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 4c8b15874c59debca7a4a68682f4c2e17142878697145f336520973a13686881
                                              • Instruction ID: 510d405c882de3d563ce17d2971652b1edec46fc361224d2f654bd123c47566b
                                              • Opcode Fuzzy Hash: 4c8b15874c59debca7a4a68682f4c2e17142878697145f336520973a13686881
                                              • Instruction Fuzzy Hash: 4C1113B6D006498FDB10CF9AD444BDEFBF4EF88228F15841AD429B7200D374A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D05B3B
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: AllocVirtual
                                              • String ID:
                                              • API String ID: 4275171209-0
                                              • Opcode ID: f91214138d686d01e80db9e0868ef2c3bc73c25ee9de988f3b68283f258f2d17
                                              • Instruction ID: 4a45979d2c4d72e238e661a8ce949ef5e0622c6ec98b9558e548633a42f675e9
                                              • Opcode Fuzzy Hash: f91214138d686d01e80db9e0868ef2c3bc73c25ee9de988f3b68283f258f2d17
                                              • Instruction Fuzzy Hash: 6411EDB5900649DFCB10CF9AD884BDEBBF8FB88324F148419E929A7250D375A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04D05B3B
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: AllocVirtual
                                              • String ID:
                                              • API String ID: 4275171209-0
                                              • Opcode ID: 10fc834315edcdfdb75c296afd0fc0944465c13089e48a424e6929bc0873e45f
                                              • Instruction ID: 7298279ec04cef0e747f0a7ac93867249d12364190fb480e88d4eab13ea3ddfd
                                              • Opcode Fuzzy Hash: 10fc834315edcdfdb75c296afd0fc0944465c13089e48a424e6929bc0873e45f
                                              • Instruction Fuzzy Hash: EB1143B5900249DFCB10CF99D985BDEBFF4BF48320F14841AE528A7650D334A554CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 013D96F6
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: ddbb103395eef3e48ef60f6e18fa5cf9a404a922a524cb6c721ea54084f25c3c
                                              • Instruction ID: ed2970c102d2cbb9574398868d2ff20af341307d6634595837a014ee3a54c686
                                              • Opcode Fuzzy Hash: ddbb103395eef3e48ef60f6e18fa5cf9a404a922a524cb6c721ea54084f25c3c
                                              • Instruction Fuzzy Hash: 3311E0B6D006498FDB10DF9AD444BDEFBF4AF88228F15841AD429B7600D378A545CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • PostMessageW.USER32(?,?,?,?), ref: 04D067A5
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: MessagePost
                                              • String ID:
                                              • API String ID: 410705778-0
                                              • Opcode ID: 0808564692850eb8e2e0deecbe299e1b809893b7d17729e3c1f30aca38fa7924
                                              • Instruction ID: 40af3713ce33eba1c413bbab7b7d2be214d982d706e231d08eeeaaaf6641eb6e
                                              • Opcode Fuzzy Hash: 0808564692850eb8e2e0deecbe299e1b809893b7d17729e3c1f30aca38fa7924
                                              • Instruction Fuzzy Hash: 9011D0B58002499FDB10CF9AD889BDEFBF8EB88324F14841AE914A7640D374A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ResumeThread.KERNELBASE(?), ref: 04D05EA7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: ResumeThread
                                              • String ID:
                                              • API String ID: 947044025-0
                                              • Opcode ID: fc181deeb85b46335135b0a04ae50dedfa6a5480467fab46e6ff06eeeb7259c7
                                              • Instruction ID: e3b350775f7aa38f0952f90f013fb880b87d156a81dd5d42c9c2b813a64a818d
                                              • Opcode Fuzzy Hash: fc181deeb85b46335135b0a04ae50dedfa6a5480467fab46e6ff06eeeb7259c7
                                              • Instruction Fuzzy Hash: CA1112B18002498FDB10CF9AD884BDFFBF8EB88324F10841AD418A7340D775A944CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • ResumeThread.KERNELBASE(?), ref: 04D05EA7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID: ResumeThread
                                              • String ID:
                                              • API String ID: 947044025-0
                                              • Opcode ID: 7a46d83ca754e26b0674f9bb0acc1a02697a88128a5a8e618df1b1b94d9661c9
                                              • Instruction ID: e6af0834b6943e4bf12da591ec81cdb27b1fae043faf54e37a77f2b2ccc63c3f
                                              • Opcode Fuzzy Hash: 7a46d83ca754e26b0674f9bb0acc1a02697a88128a5a8e618df1b1b94d9661c9
                                              • Instruction Fuzzy Hash: 2C1100B58002498FDB10CF99D585BDEFBF8AF88224F14885AD468B7740D378A944CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ca16cdce476575da49089ba56d69977a3a1ecfec10035a202cfe29dc167b5d1d
                                              • Instruction ID: d529987852d552d80f68a9d168ec7f6c56308d6c5ca6988669cd31e0155b3fcc
                                              • Opcode Fuzzy Hash: ca16cdce476575da49089ba56d69977a3a1ecfec10035a202cfe29dc167b5d1d
                                              • Instruction Fuzzy Hash: 82214871504240DFCB01DF94D8C5B2BBFA5FB88728F24C5ADDA450B646C336D856C7A2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 06bdca6de44915335c6afe57f7194bc7b12b881ad6750bed27d1e9b81233e074
                                              • Instruction ID: 7680e0fc501f0ae61b9fd58d06365436342e0007992d6f49385ad1cefe9b5030
                                              • Opcode Fuzzy Hash: 06bdca6de44915335c6afe57f7194bc7b12b881ad6750bed27d1e9b81233e074
                                              • Instruction Fuzzy Hash: 29214871504200DFDB05CF84C8C1B5BBBA5FB88324F20C5ADEA490B606C73AF856C7A2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303389575.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b777bc1988182d122fba0fd4789464707155f963b3b17f6f29a13a524eefe8b9
                                              • Instruction ID: 6569012675db048c8756e90f4b91e58fc45332810b28bd23b6b6f09f1dcfc9e3
                                              • Opcode Fuzzy Hash: b777bc1988182d122fba0fd4789464707155f963b3b17f6f29a13a524eefe8b9
                                              • Instruction Fuzzy Hash: E521F571504204EFDB06DFD4D9D0B26BBE9FB84328F24C969E8094B686C73AD856CA61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303389575.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 7dcd6cb9c32539e58a2f034f26ecb25d68f2e7ea5dc0a9ab2d423a89dfe36711
                                              • Instruction ID: fd07262064e9ed8e28fb5ac8c8adf8dc952e7613f4ba111d94a45b3253fad430
                                              • Opcode Fuzzy Hash: 7dcd6cb9c32539e58a2f034f26ecb25d68f2e7ea5dc0a9ab2d423a89dfe36711
                                              • Instruction Fuzzy Hash: 30212571504204DFDB16CF94D8D4B16BBE9FB84368F20C969D80D4B786C33AD847CA62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9154f6813b35f5e849061fcfaf88a5200d9197f54dc6ddbdd48086d4df7a377
                                              • Instruction ID: b9bc4688f4f09d0a3fae41ba1e37b9a91719e18386285e7b49c9df7164ae456f
                                              • Opcode Fuzzy Hash: f9154f6813b35f5e849061fcfaf88a5200d9197f54dc6ddbdd48086d4df7a377
                                              • Instruction Fuzzy Hash: 0611AF76404280DFDB12CF54D5C4B56BFB1FB84324F24C6ADD9490BA56C33AE45ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9154f6813b35f5e849061fcfaf88a5200d9197f54dc6ddbdd48086d4df7a377
                                              • Instruction ID: 3873d45feb8bfd7dcd11a9d4f4374dba53ffb3ef3dddd80aeead4dbe6e623e0d
                                              • Opcode Fuzzy Hash: f9154f6813b35f5e849061fcfaf88a5200d9197f54dc6ddbdd48086d4df7a377
                                              • Instruction Fuzzy Hash: B111AF76404280CFCB12CF54D5C4B16BFB1FB84724F24C6ADD9450B656C33AD45ADBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303389575.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction ID: 5165ddc06b71c05bab351118ace048f6e5714cae2318c03b603e4717547e5f84
                                              • Opcode Fuzzy Hash: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction Fuzzy Hash: D011D075504280CFCB12CF54D5D4B15FFA1FB44328F24C6AAD8094B796C33AD44ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303389575.000000000130D000.00000040.00000001.sdmp, Offset: 0130D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction ID: 738e4da0d47e1bd84adfa0f5d4c08dfafdef1b6869ed9f9e806020b72b28cbe7
                                              • Opcode Fuzzy Hash: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction Fuzzy Hash: E211BB75504280DFCB12CF98C5D4B15BFB1FB84228F28C6AAD8494B696C33AD45ACB61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c201a798f01105cd80a21974fbd69545c3256b07a0a8c56c2f2f37ab1fc755f3
                                              • Instruction ID: b4bcc4dd83a4e2e1c152edce5cf60691ad563d73d01464f57647c0e76c31b40b
                                              • Opcode Fuzzy Hash: c201a798f01105cd80a21974fbd69545c3256b07a0a8c56c2f2f37ab1fc755f3
                                              • Instruction Fuzzy Hash: 560147710083D09AE7114AA9CC85B6BBBD8FF41224F08855EEB440E642E738D840C7B1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.302945427.00000000010FD000.00000040.00000001.sdmp, Offset: 010FD000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 77d5c43bc21f5fdc96d3dc6bad334cd061aeaca482cf1e5a0be0efb990ff4e2a
                                              • Instruction ID: dad8342831816b0e819cbe5bdb819e7d5e45bbc48140932adcebc77b0c81d939
                                              • Opcode Fuzzy Hash: 77d5c43bc21f5fdc96d3dc6bad334cd061aeaca482cf1e5a0be0efb990ff4e2a
                                              • Instruction Fuzzy Hash: 10F0C271404394AEE7518E19CC84B66FFD8EB81634F18C45AEE481F687D3799844CBB0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 8807fe5780447794093201e981664968c28ed8ceda823ca41605b383ebd1dbf9
                                              • Instruction ID: 9097eb00bf5ae88e699dc4cd80496d0b5edd18a39d02b3205e511a8ae5490ce6
                                              • Opcode Fuzzy Hash: 8807fe5780447794093201e981664968c28ed8ceda823ca41605b383ebd1dbf9
                                              • Instruction Fuzzy Hash: BAD1BC74E0021A9FCB05DFA8D4957EEBBF6BF88314F10C829D515B7394EB34A9418BA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.303634016.00000000013D0000.00000040.00000001.sdmp, Offset: 013D0000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: fb19016adf325f9138dce2ed72a7d8d88ec89642391a5b1aaf3bd87a2710058d
                                              • Instruction ID: 1d5086fcf1fd0a6fc16db21072807c1239e0d8efcf72000170f07c6b5fd979ed
                                              • Opcode Fuzzy Hash: fb19016adf325f9138dce2ed72a7d8d88ec89642391a5b1aaf3bd87a2710058d
                                              • Instruction Fuzzy Hash: D9A16F32E1021A8FCF15DFE9D84459EBBF6FF88304B15816AE905BB261DB71A915CB40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 6516b2ef36bfa205cd3f407f22173d969078e9c1a54686655097df995fcf1a7f
                                              • Instruction ID: 22a4af071fa04afc0f3b125c46fbea8c2f372ece38a8ed3728f5a31c3bc0f0cc
                                              • Opcode Fuzzy Hash: 6516b2ef36bfa205cd3f407f22173d969078e9c1a54686655097df995fcf1a7f
                                              • Instruction Fuzzy Hash: 8071F374E1520A8FDB04DFA5D481AEEFBB2EF89300F10D42AD815B7354E734AA468F95
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 344e0be535cccf56dfb42bea6637006306e2e65a9a35664babd7b5f4635dfbb8
                                              • Instruction ID: 10e0ee5201af33e77763f14eecd191f4b8c6c08b710ea9ce225121ea960a2117
                                              • Opcode Fuzzy Hash: 344e0be535cccf56dfb42bea6637006306e2e65a9a35664babd7b5f4635dfbb8
                                              • Instruction Fuzzy Hash: 8671E474E1520ACFDB04DFA5D481AEEBBB2EF89300F10D42AD815B7354E734AA468F95
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b3bcdf552a09d18dff2ff51ccdb2c43ff5bb59375a2ec0fc40672febb3c91d00
                                              • Instruction ID: 137a8858a484f84f0743609ff8ed9030141f283d65834ae6d55b6a3e71ef290e
                                              • Opcode Fuzzy Hash: b3bcdf552a09d18dff2ff51ccdb2c43ff5bb59375a2ec0fc40672febb3c91d00
                                              • Instruction Fuzzy Hash: C3513D71E0062ACBDB24CF65DD44BAAB7B2FFC9300F1085FAD509A7654EB709A859F40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: eeeb1bfaef34500411d07f0338ee560f5cd8e8f51c377bc0febb398f972dd58c
                                              • Instruction ID: b8c69fcbfb3c8cd29950ae4276a1d7e6641f1ff9c1ef538df6de7b79dc13584e
                                              • Opcode Fuzzy Hash: eeeb1bfaef34500411d07f0338ee560f5cd8e8f51c377bc0febb398f972dd58c
                                              • Instruction Fuzzy Hash: E651FC70E012199FDB18CF9AD885B9EF7B2FB88310F14C1A9D559A7394DB306941CF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b45ba1a7f72439c05d4e7eac03b809a91c7673e611cc99ed98d9cabaf85f9ed4
                                              • Instruction ID: 9058ceff6495de29bfe0cdfe045bb1f6a7e1ffab1634fe9555221879b9439881
                                              • Opcode Fuzzy Hash: b45ba1a7f72439c05d4e7eac03b809a91c7673e611cc99ed98d9cabaf85f9ed4
                                              • Instruction Fuzzy Hash: 8D512B70E012198FDB18CFAAD8857AEFBB2BB88310F14C1AAD549A7295DB309D41CF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 213d81af4215056592652e635c198a3df5fcc8d3075bf09484e0202fa6479800
                                              • Instruction ID: ec91aa97f8c37fa191e20c302524aaff893a9ae759029467a9edb897c3e8b818
                                              • Opcode Fuzzy Hash: 213d81af4215056592652e635c198a3df5fcc8d3075bf09484e0202fa6479800
                                              • Instruction Fuzzy Hash: D0514F71E0062A8BDB24CF65CD4479ABBB2FFC9300F1081FAD509A7654EB705AC59F40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000000.00000002.311863716.0000000004D00000.00000040.00000001.sdmp, Offset: 04D00000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: c2e59a190e7acb548ce8c58e8fac2283780b472a9787a9acb2519266f635aca3
                                              • Instruction ID: bc935c68476b35d1636a1e289c7ecb8775bb4bbd9f6a7f79c505c561e6a9ab58
                                              • Opcode Fuzzy Hash: c2e59a190e7acb548ce8c58e8fac2283780b472a9787a9acb2519266f635aca3
                                              • Instruction Fuzzy Hash: 0D512970E0162ACFDB24CF65C944BDABBB2FF99300F1085EAD519A7650EB709AC49F41
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C10
                                              • GetCurrentThread.KERNEL32 ref: 032E6C4D
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C8A
                                              • GetCurrentThreadId.KERNEL32 ref: 032E6CE3
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 58aae5ce74d64d9ba37ba82ade93f348c800ff3a890025d6ea62a92f08c96b39
                                              • Instruction ID: e9feee65a6c0e495f9c7c941f1386366ebd0df2ec13bcb9d1a1ed9b87128fd46
                                              • Opcode Fuzzy Hash: 58aae5ce74d64d9ba37ba82ade93f348c800ff3a890025d6ea62a92f08c96b39
                                              • Instruction Fuzzy Hash: 0A5188B0910749CFDB01CFA9C5897AEBBF1FF59304F14845AE419A7361DB349888CB62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C10
                                              • GetCurrentThread.KERNEL32 ref: 032E6C4D
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C8A
                                              • GetCurrentThreadId.KERNEL32 ref: 032E6CE3
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: 9c78e1470f280b8a545b8c9f6591ed1056f7b92be11f45a231c512ca1e9ae2f5
                                              • Instruction ID: a033253c314fe2555239c525a59026136fc929e174c59a77eb1e53b6b17bee05
                                              • Opcode Fuzzy Hash: 9c78e1470f280b8a545b8c9f6591ed1056f7b92be11f45a231c512ca1e9ae2f5
                                              • Instruction Fuzzy Hash: F35166B09106498FDB10CFAAD589BDEFBF1EF58314F248459E419A7360DB34A884CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C10
                                              • GetCurrentThread.KERNEL32 ref: 032E6C4D
                                              • GetCurrentProcess.KERNEL32 ref: 032E6C8A
                                              • GetCurrentThreadId.KERNEL32 ref: 032E6CE3
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: Current$ProcessThread
                                              • String ID:
                                              • API String ID: 2063062207-0
                                              • Opcode ID: c7c8007ace5a2ba496d3047c0b253f161984ad4b981e74ab9bbbda9913642825
                                              • Instruction ID: 28758fb13886c1e67cff19ef7e257f26e03091ba7d5ef8fe97abdd34e7f3867c
                                              • Opcode Fuzzy Hash: c7c8007ace5a2ba496d3047c0b253f161984ad4b981e74ab9bbbda9913642825
                                              • Instruction Fuzzy Hash: BB5198B0A10249CFDB00CFA9C5497EEBFF0EF59304F248459E519A73A1DB356889CB62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032E5302
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: 48b43cff48ffe12a1561139c03d8f72accaa1dca3b920bb025db999aa6bb5898
                                              • Instruction ID: 0c66134ac062ee978002e90a7d85cfe4bebd30ccfac370863729d8c278c2892c
                                              • Opcode Fuzzy Hash: 48b43cff48ffe12a1561139c03d8f72accaa1dca3b920bb025db999aa6bb5898
                                              • Instruction Fuzzy Hash: 4441B1B1D10349DFDB14CF9AC884ADEFBB5BF49314F64812AE819AB210D7B49985CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 032E5302
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: CreateWindow
                                              • String ID:
                                              • API String ID: 716092398-0
                                              • Opcode ID: d8be9cd394267e9e3e3efaede7443586790d8180c3bb1f1ba076371f8692c83d
                                              • Instruction ID: e339403a4207c519b73677d0fadde4184ccb92d58db378fe174afc07038c492d
                                              • Opcode Fuzzy Hash: d8be9cd394267e9e3e3efaede7443586790d8180c3bb1f1ba076371f8692c83d
                                              • Instruction Fuzzy Hash: 4C51DEB1D10309DFDB14CF99C884ADEFBB5BF48314F64812AE819AB210D7B49885CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 032E7D61
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: CallProcWindow
                                              • String ID:
                                              • API String ID: 2714655100-0
                                              • Opcode ID: ea62501b82786154a27b8b0a17bdf92d3cf2366a3ab9b5705f1be4e4d820734a
                                              • Instruction ID: 00cfbec099e025f094f28703cc2e689301aed2376fe07ada5603476678540a94
                                              • Opcode Fuzzy Hash: ea62501b82786154a27b8b0a17bdf92d3cf2366a3ab9b5705f1be4e4d820734a
                                              • Instruction Fuzzy Hash: 4D413AB9A10305CFCB14CF99C489AAAFBF5FF88314F158459D519AB321D774A881CFA0
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • RtlEncodePointer.NTDLL(00000000), ref: 032EC4A2
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: EncodePointer
                                              • String ID:
                                              • API String ID: 2118026453-0
                                              • Opcode ID: fe3ca9313be0e8dba840f4b2022c7557a18d3b094be49df44ab124c974ac3340
                                              • Instruction ID: 9c2ae1120e2188dc4e49bd93c2b7eb7777a536d40c68d220dc8913d7b7795bdc
                                              • Opcode Fuzzy Hash: fe3ca9313be0e8dba840f4b2022c7557a18d3b094be49df44ab124c974ac3340
                                              • Instruction Fuzzy Hash: 513158B54143818FDB10DFA8D50939E7FF4EB46318F44405AD889E7342D7786848CF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 032E6E5F
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: c95083df8caa5350637d3947e346bac86a846bfad0d56f633ff57449f01d5c90
                                              • Instruction ID: c3ed428312d0deab804d2241b2c39c3d8b255ec05a0e2e3b17027e5db034ac24
                                              • Opcode Fuzzy Hash: c95083df8caa5350637d3947e346bac86a846bfad0d56f633ff57449f01d5c90
                                              • Instruction Fuzzy Hash: E821F3B5900209EFDB10CFAAD884ADEFBF8FB48324F14841AE914A7350D774A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 032E6E5F
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: DuplicateHandle
                                              • String ID:
                                              • API String ID: 3793708945-0
                                              • Opcode ID: f50f760d7330f2d6e4dc3d232843a6a008c76ef2c12913553c513f585c9ed44b
                                              • Instruction ID: 9447bd4ea8006d5b849ae8c8b3bbd74e4aa2a4c39bf1ced3cf8c5640ad7c0202
                                              • Opcode Fuzzy Hash: f50f760d7330f2d6e4dc3d232843a6a008c76ef2c12913553c513f585c9ed44b
                                              • Instruction Fuzzy Hash: 4221DFB5900209AFDB10CFA9D584ADEBBF4EB48324F14841AE914A7351D378A954CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              APIs
                                              • RtlEncodePointer.NTDLL(00000000), ref: 032EC4A2
                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481683217.00000000032E0000.00000040.00000001.sdmp, Offset: 032E0000, based on PE: false
                                              Similarity
                                              • API ID: EncodePointer
                                              • String ID:
                                              • API String ID: 2118026453-0
                                              • Opcode ID: fb433e60b2d37dedc06b3e169925b02f95e3a0baa526a822eec0d12c74c96657
                                              • Instruction ID: c7313f1ac329ec8ec20c87de723c446a81a5ed2e1e4a5b2b2be6697d67c215d3
                                              • Opcode Fuzzy Hash: fb433e60b2d37dedc06b3e169925b02f95e3a0baa526a822eec0d12c74c96657
                                              • Instruction Fuzzy Hash: 2E11EEB19103058FCB10EFAAC40979EBBF4FB49314F54842AD959E7700DB386884CFA1
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481007567.000000000184D000.00000040.00000001.sdmp, Offset: 0184D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: cdeeed5dc98c453ba1472f1c2f82f65022762dfc5229d80518007ce1a7f546f3
                                              • Instruction ID: 848ab2b16125d38c3d4abb7822176c6fd51be097b3300cf208c380c695acb847
                                              • Opcode Fuzzy Hash: cdeeed5dc98c453ba1472f1c2f82f65022762dfc5229d80518007ce1a7f546f3
                                              • Instruction Fuzzy Hash: D9213471504308DFCB15CF94D8C4B16BBA5FB98368F20CA6DD8098B346CB3AD947CA62
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Memory Dump Source
                                              • Source File: 00000013.00000002.481007567.000000000184D000.00000040.00000001.sdmp, Offset: 0184D000, based on PE: false
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction ID: 2a0597976b695232ad7ce960d210050dc8378adf3828be89bedf4730302b89df
                                              • Opcode Fuzzy Hash: 9c1c4d15945f75f5c7145bd3be0d7b4ff171933bea9630414cfd87ddfd5d3604
                                              • Instruction Fuzzy Hash: 7B11BB75504284CFCB12CF54D5C4B16BFA1FB84324F28C6AAD8098B656C33AD54ACBA2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions