Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe

Overview

General Information

Sample Name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
Analysis ID:433045
MD5:7792ed45165589f6518121b7015dc516
SHA1:c0ce682e0f3561e3a7540c15e5cc08e69c0ab53a
SHA256:2dbc1e319c840368cea5d83819feafbfaec855e245438e8e50105c464c422953
Tags:exe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Yara detected AntiVM3
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code contains very large strings
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
      00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
          00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 9 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackJoeSecurity_AgentTesla_2Yara detected AgentTeslaJoe Security
                    19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 5 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpMalware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales1@ashtavinayaka.com123456789smtpout.secureserver.net"}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeVirustotal: Detection: 40%Perma Link
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeMetadefender: Detection: 17%Perma Link
                      Source: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeReversingLabs: Detection: 32%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeVirustotal: Detection: 32%Perma Link
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMetadefender: Detection: 17%Perma Link
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeReversingLabs: Detection: 32%
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpackAvira: Label: TR/Spy.Gen8
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: http://kqfOpU.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303002904.000000000110B000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b92C625F0u002dCB9Cu002d42BAu002d9B29u002d09C40FFF2B0Bu007d/C9292A3Cu002d0320u002d42D4u002d932Fu002d56A5FC9F4AD5.csLarge array initialization: .cctor: array initializer size 11943
                      .NET source code contains very large stringsShow sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.2.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.1.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.0.unpack, ContactManagement/ContactForm.csLong String: Length: 11840
                      Initial sample is a PE file and has a suspicious nameShow sources
                      Source: initial sampleStatic PE information: Filename: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DE690
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DC234
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_013DE682
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03D60
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D030C0
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D00040
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03D50
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D00520
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03FC8
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03FB9
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D030B7
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D00007
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D041AD
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03A70
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D03A61
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D02A10
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D02A00
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E47B3
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E4827
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032ED880
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.316834328.00000000076E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.317584678.000000000D420000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameWindowsNetwork.dll> vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303002904.000000000110B000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000012.00000000.299366791.000000000016C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameNpXVsfKmoYCvTOuLtBSSAxQUjXePN.exe4 vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000000.300836805.0000000000F3C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeBinary or memory string: OriginalFilenameUHLv.exeF vs Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: XzPoCGKinsp.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@8/3@0/0
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeJump to behavior
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_01
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMutant created: \Sessions\1\BaseNamedObjects\TGVQnnhcxn
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Local\Temp\tmpDAD0.tmpJump to behavior
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeVirustotal: Detection: 32%
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMetadefender: Detection: 17%
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeReversingLabs: Detection: 32%
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile read: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe 'C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

                      Data Obfuscation:

                      barindex
                      .NET source code contains method to dynamically call methods (often used by packers)Show sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: XzPoCGKinsp.exe.0.dr, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 0.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.9c0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 18.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.f0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.2.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.1.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.ec0000.0.unpack, ContactManagement/ContactForm.cs.Net Code: LateBinding.LateCall(V_1, null, "Invoke", new object[] { 0, V_0 }, null, null)
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D04B41 push esi; retf
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_04D04B37 push esi; retf
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 0_2_052BED30 pushfd ; ret
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeCode function: 19_2_032E5525 push ss; iretd
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.69660468542
                      Source: initial sampleStatic PE information: section name: .text entropy: 7.69660468542
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: \request for quotation and starting a new businesss relationship with producestrade.exe
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile created: C:\Users\user\AppData\Roaming\XzPoCGKinsp.exeJump to dropped file

                      Boot Survival:

                      barindex
                      Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Yara detected AntiVM3Show sources
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWindow / User API: threadDelayed 1665
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWindow / User API: threadDelayed 8189
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5644Thread sleep time: -922337203685477s >= -30000s
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 2000Thread sleep time: -12912720851596678s >= -30000s
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5024Thread sleep count: 1665 > 30
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe TID: 5024Thread sleep count: 8189 > 30
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeThread delayed: delay time: 922337203685477
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: vmware
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMWARE
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Injects a PE file into a foreign processesShow sources
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeMemory written: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe base: 400000 value starts with: 4D5A
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeProcess created: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe {path}
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Program Manager
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481309744.0000000001D10000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892, type: MEMORY
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3f9e230.5.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.3dd46a0.4.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Scheduled Task/Job1Process Injection112Masquerading1Input Capture1Security Software Discovery321Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1Boot or Logon Initialization ScriptsScheduled Task/Job1Disable or Modify Tools1LSASS MemoryProcess Discovery2Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion141Security Account ManagerVirtualization/Sandbox Evasion141SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsSystem Information Discovery113VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe33%VirustotalBrowse
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe20%MetadefenderBrowse
                      Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe33%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Dropped Files

                      SourceDetectionScannerLabelLink
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe41%VirustotalBrowse
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe20%MetadefenderBrowse
                      C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe33%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      19.0.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.1.unpack100%AviraTR/Spy.Gen8Download File
                      19.2.Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File

                      Domains

                      No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://kqfOpU.com0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://127.0.0.1:HTTP/1.1Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		low
                      http://www.apache.org/licenses/LICENSE-2.0Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.fontbureau.com/designersGRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                            		high
                            http://DynDns.comDynDNSRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/?Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/bTheRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers?Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.tiro.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designersRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.carterandcone.comlRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.sajatypeworks.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.typography.netDRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/cabarga.htmlNRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.founder.com.cn/cn/cTheRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.galapagosdesign.com/staff/dennis.htmRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://fontfabrik.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.founder.com.cn/cnRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers/frere-jones.htmlRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.jiyu-kobo.co.jp/Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.galapagosdesign.com/DPleaseRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers8Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                        		high
                                        http://www.fonts.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.sandoll.co.krRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.urwpp.deDPleaseRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.zhongyicts.com.cnRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.303870090.0000000002D01000.00000004.00000001.sdmpfalse
                                            		high
                                            http://www.sakkal.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.313527926.0000000005CE0000.00000002.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            		unknown
                                            http://kqfOpU.comRequest For Quotation And Starting A new Businesss Relationship With Producestrade.exe, 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown

                                            Contacted IPs

                                            No contacted IP infos

                                            General Information

                                            Joe Sandbox Version:32.0.0 Black Diamond
                                            Analysis ID:433045
                                            Start date:11.06.2021
                                            Start time:08:12:19
                                            Joe Sandbox Product:CloudBasic
                                            Overall analysis duration:0h 8m 51s
                                            Hypervisor based Inspection enabled:false
                                            Report type:light
                                            Sample file name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                            Number of analysed new started processes analysed:29
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • HDC enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Detection:MAL
                                            Classification:mal100.troj.evad.winEXE@8/3@0/0
                                            EGA Information:Failed
                                            HDC Information:Failed
                                            HCA Information:
                                            • Successful, ratio: 100%
                                            • Number of executed functions: 0
                                            • Number of non-executed functions: 0
                                            Cookbook Comments:
                                            • Adjust boot time
                                            • Enable AMSI
                                            • Found application associated with file extension: .exe
                                            Warnings:
                                            Show All
                                            • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            08:14:07API Interceptor509x Sleep call for process: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            No context

                                            Domains

                                            No context

                                            ASN

                                            No context

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe.log
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1216
                                            Entropy (8bit):5.355304211458859
                                            Encrypted:false
                                            SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                            MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                            SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                            SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                            SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                            Malicious:true
                                            Reputation:high, very likely benign file
                                            Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21
                                            C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):1644
                                            Entropy (8bit):5.191913760884606
                                            Encrypted:false
                                            SSDEEP:24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBvhPtn:cbh47TlNQ//rydbz9I3YODOLNdq31
                                            MD5:CCF95DC96B7BD87A01055032CE0CD57A
                                            SHA1:10B8216829D3DD59A64A4A5F7ABB344501A79201
                                            SHA-256:75F1F589EC1E5F1837421327A67518EBE99E02FFD7A2B2C3BCD92565A87ACE28
                                            SHA-512:9C109BEB3F234467F39BE0A9A77C8D3C44434744EC17B46E22203D7E73E6D66C1CD0F97892DAD97E47E9AA15FC5223892A0C87AE9AF3CF1CAB7488E9C06396AA
                                            Malicious:true
                                            Reputation:low
                                            Preview: <?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true
                                            C:\Users\user\AppData\Roaming\XzPoCGKinsp.exe
                                            Process:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Category:dropped
                                            Size (bytes):499712
                                            Entropy (8bit):7.663532105306135
                                            Encrypted:false
                                            SSDEEP:12288:jzuwEDaodkRgQbC89xGaFhod8iP+sW+W:jzu3eEkRgqCyaqurW+
                                            MD5:7792ED45165589F6518121B7015DC516
                                            SHA1:C0CE682E0F3561E3A7540C15E5CC08E69C0AB53A
                                            SHA-256:2DBC1E319C840368CEA5D83819FEAFBFAEC855E245438E8E50105C464C422953
                                            SHA-512:9D0DFAE32CADDDA0B33708160361E794A1DE1ED483BC62817AC0800B3969BA404E3495B7CA07D87AD678BE0E45AF5628C0F2F67773FA851EBDA20FABFB65EEFB
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Virustotal, Detection: 41%, Browse
                                            • Antivirus: Metadefender, Detection: 20%, Browse
                                            • Antivirus: ReversingLabs, Detection: 33%
                                            Reputation:low
                                            Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{Y.`..............0.................. ........@.. ....................................@.....................................O.......\............................................................................ ............... ..H............text........ ...................... ..`.rsrc...\...........................@..@.reloc..............................@..B.......................H.......@...........?....w...0..........................................^.(........}......}....*.0............t......t......o.....{....o....o......o.....{....o....o......o.....{....o....o.....o.....{....o....o.....(.......{........,....e..+......+...*..0............}.....(.......(......r...p.(....(....o......{.....(....o......{....r...po......{.....(....o......{.....(....o......{.....(....o.....*..0.._........(.........(.....o............,)....t......o....r!..p( .....,..o....

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                            Entropy (8bit):7.663532105306135
                                            TrID:
                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                            • Win32 Executable (generic) a (10002005/4) 49.75%
                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                            • Windows Screen Saver (13104/52) 0.07%
                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                            File name:Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            File size:499712
                                            MD5:7792ed45165589f6518121b7015dc516
                                            SHA1:c0ce682e0f3561e3a7540c15e5cc08e69c0ab53a
                                            SHA256:2dbc1e319c840368cea5d83819feafbfaec855e245438e8e50105c464c422953
                                            SHA512:9d0dfae32caddda0b33708160361e794a1de1ed483bc62817ac0800b3969ba404e3495b7ca07d87ad678be0e45af5628c0f2f67773fa851ebda20fabfb65eefb
                                            SSDEEP:12288:jzuwEDaodkRgQbC89xGaFhod8iP+sW+W:jzu3eEkRgqCyaqurW+
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{Y.`..............0.................. ........@.. ....................................@................................

                                            File Icon

                                            Icon Hash:18da1abcb2d2d2b0

                                            Static PE Info

                                            General

                                            Entrypoint:0x47a80a
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                            DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                            Time Stamp:0x60C2597B [Thu Jun 10 18:27:07 2021 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:v4.0.30319
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                            Entrypoint Preview

                                            Instruction
                                            jmp dword ptr [00402000h]
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al
                                            add byte ptr [eax], al

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x7a7b80x4f.text
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x7c0000x105c.rsrc
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x7e0000xc.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x20000x788100x78a00False0.867159164508data7.69660468542IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                            .rsrc0x7c0000x105c0x1200False0.270399305556data2.85309442637IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x7e0000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_ICON0x7c1000x8a8dBase III DBT, version number 0, next free block index 40
                                            RT_GROUP_ICON0x7c9b80x14data
                                            RT_VERSION0x7c9dc0x480data
                                            RT_MANIFEST0x7ce6c0x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                                            Imports

                                            DLLImport
                                            mscoree.dll_CorExeMain

                                            Version Infos

                                            DescriptionData
                                            Translation0x0000 0x04b0
                                            LegalCopyrightDecember 19th, 2006
                                            Assembly Version1.0.7.8
                                            InternalNameUHLv.exe
                                            FileVersion1.0.7.8
                                            CompanyNameCoded by James O'Cull
                                            LegalTrademarks
                                            CommentsContact management is a solution for anyone who needs to be able to access their list of contacts from removable media without any installation.
                                            ProductNameContact Management
                                            ProductVersion1.0.7.8
                                            FileDescriptionContact Management
                                            OriginalFilenameUHLv.exe

                                            Network Behavior

                                            No network behavior found

                                            Code Manipulations

                                            Statistics

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            Analysis Process: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5640 Parent PID: 5568

                                            General

                                            Start time:08:13:11
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe'
                                            Imagebase:0x9c0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.308344946.0000000003D09000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.311555841.0000000003EA6000.00000004.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Analysis Process: schtasks.exe PID: 4092 Parent PID: 5640

                                            General

                                            Start time:08:13:52
                                            Start date:11/06/2021
                                            Path:C:\Windows\SysWOW64\schtasks.exe
                                            Wow64 process (32bit):true
                                            Commandline:'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\XzPoCGKinsp' /XML 'C:\Users\user\AppData\Local\Temp\tmpDAD0.tmp'
                                            Imagebase:0xa60000
                                            File size:185856 bytes
                                            MD5 hash:15FF7D8324231381BAD48A052F85DF04
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            Analysis Process: conhost.exe PID: 5452 Parent PID: 4092

                                            General

                                            Start time:08:13:52
                                            Start date:11/06/2021
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff6b2800000
                                            File size:625664 bytes
                                            MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            Analysis Process: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 3148 Parent PID: 5640

                                            General

                                            Start time:08:13:53
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):false
                                            Commandline:{path}
                                            Imagebase:0xf0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low

                                            Analysis Process: Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe PID: 5892 Parent PID: 5640

                                            General

                                            Start time:08:13:53
                                            Start date:11/06/2021
                                            Path:C:\Users\user\Desktop\Request For Quotation And Starting A new Businesss Relationship With Producestrade.exe
                                            Wow64 process (32bit):true
                                            Commandline:{path}
                                            Imagebase:0xec0000
                                            File size:499712 bytes
                                            MD5 hash:7792ED45165589F6518121B7015DC516
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:.Net C# or VB.NET
                                            Yara matches:
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000013.00000002.478253369.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000002.481834847.0000000003331000.00000004.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            • Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000013.00000000.300691814.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
                                            Reputation:low

                                            Disassembly

                                            Code Analysis

                                            Reset < >