Windows Analysis Report RFQ-BCM 03122020.exe

AV Detection:

Found malware configuration

Source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.jiltedowl.com/um8e/"], "decoy": ["theypretend.com", "hopeschildren.com", "kuly.cloud", "maniflexx.net", "bedtimesocietyblog.com", "spenglerwetlandpreserve.com", "unity-play.net", "bonap56.com", "consciencevc.com", "deluxeluxe.com", "officialjuliep.com", "cttrade.club", "quietflyt.com", "mcabspl.com", "lippocaritahotel.com", "tolanfilms.xyz", "momenaagro.com", "slingshotart.com", "thefoundershuddle.com", "mobilbaris.com", "castlerockbotanicals.com", "dautusim.com", "tolteca.club", "saddletaxweigh.info", "oxydiumcorp.com", "themiamadison.com", "888luckys.net", "brandsuggestion.com", "jusdra.com", "therios.net", "helpushelpothersstore.com", "pornometal.com", "whejvrehj.com", "ngzhaohern.com", "slaskie.pro", "heuristicadg.com", "angrybird23blog.com", "my-bmi.space", "lufral.com", "influenced-brands.com", "vicdux.life", "top1opp.com", "techiedrill.com", "sitedesing.com", "bigtittylesbians.com", "xspinworks14.com", "alturadesingfit.com", "venturivasiljevic.com", "yxsj.info", "yorkshirebridalmakeup.info", "shopinnocenceeyejai.com", "yinhangli.com", "tickimumm.com", "xn--939am40byoeizq.com", "customerservuce.com", "blendoriginal.com", "freelancebizquiz.com", "matjar-lik.com", "bellaxxocosmetics.com", "gxdazj.com", "findbriefmarken.com", "pubgevents1.com", "metis.network", "eternapure.net"]}

Multi AV Scanner detection for submitted file

Source: RFQ-BCM 03122020.exe	Virustotal: Detection: 20%			Perma Link
Source: RFQ-BCM 03122020.exe	ReversingLabs: Detection: 21%

Yara detected FormBook

Source: Yara match	File source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: RFQ-BCM 03122020.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 13.2.chkdsk.exe.4675830.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 13.2.chkdsk.exe.5097960.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: RFQ-BCM 03122020.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: chkdsk.pdbGCTL source: RFQ-BCM 03122020.exe, 00000003.00000002.305148472.0000000000A40000.00000040.00000001.sdmp
Source:	Binary string: chkdsk.pdb source: RFQ-BCM 03122020.exe, 00000003.00000002.305148472.0000000000A40000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ-BCM 03122020.exe, 00000002.00000003.250609113.00000000098A0000.00000004.00000001.sdmp, RFQ-BCM 03122020.exe, 00000003.00000002.305161536.0000000000B50000.00000040.00000001.sdmp, chkdsk.exe, 0000000D.00000002.518417672.0000000004B60000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ-BCM 03122020.exe, chkdsk.exe

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		2_2_00405302
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_00405CD8 FindFirstFileA,FindClose,		2_2_00405CD8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_0040263E FindFirstFileA,		2_2_0040263E

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 4x nop then pop edi		3_2_0040C3EE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 4x nop then pop edi		3_1_0040C3EE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 4x nop then pop edi		13_2_0012C3EE

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49740 -> 104.252.53.222:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49740 -> 104.252.53.222:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49740 -> 104.252.53.222:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.jiltedowl.com/um8e/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /um8e/?4h=KKIQ4+/JXGLy+NPKOmU9hT636Guj5rKZNfTWQVYkTfV7RhYYbHnV1SAJBWZXUUxQase4&z6AhC6=4h0836-hg HTTP/1.1Host: www.jiltedowl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=+OafPWEw6Z0Z/R6BCooy8AJa5dJFYQpN1/QWnuYdhiYhG0yayK8Tfl0bClCAF0vxrCxk&z6AhC6=4h0836-hg HTTP/1.1Host: www.slingshotart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=Yr1O9d2lyD9rL0BsR5AOXBjd9Tt7L5u6HmDWn6NeMbq+6FaKs7VlSuQ+xmgdPYl8Ubqc&z6AhC6=4h0836-hg HTTP/1.1Host: www.venturivasiljevic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=Xi9PH5iXPg7OqoK0h1gN6IvgnIc5gotQ/5tv039xv1j+fqecGtXMWbrdMdu22zA2SdJt&z6AhC6=4h0836-hg HTTP/1.1Host: www.helpushelpothersstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=xbMoviQlEnjsHrEbTPTiLAbjABxJdIVdbR0FO8anDWX5sWiRIQHIKvYrn6XTqKSl/tf+&z6AhC6=4h0836-hg HTTP/1.1Host: www.vicdux.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=jQU7CxI2ATQsp+gAQw0922hAeD0Z0/nKIEFQeuBuNEOev1XtQ7gaXUtk4Kl0GHqLnKhz&z6AhC6=4h0836-hg HTTP/1.1Host: www.lippocaritahotel.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=5AA2OBt9f+luPmvaEKU5k+Cesx0roAkoENQvosg49Q0qMzSHjZ+2qPqQ9q6NL9KFhBoB&z6AhC6=4h0836-hg HTTP/1.1Host: www.sitedesing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=NkJAbAW12eli3K5LHnKsR+Euvd9TZZ9XHnn7bgS23Br3geXrqL1EBTSK/IXVH0nBwn3R&z6AhC6=4h0836-hg HTTP/1.1Host: www.themiamadison.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=OS+4PEF1Ll0k0ag4LLFRlEV4qtlkwOP7xXHx1u8kCQ7qmPGCq8FzaBf5dHjLd1oRWXdL&z6AhC6=4h0836-hg HTTP/1.1Host: www.influenced-brands.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 100.24.208.97 100.24.208.97
Source: Joe Sandbox View	IP Address: 192.0.78.24 192.0.78.24

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: AUTOMATTICUS AUTOMATTICUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /um8e/?4h=KKIQ4+/JXGLy+NPKOmU9hT636Guj5rKZNfTWQVYkTfV7RhYYbHnV1SAJBWZXUUxQase4&z6AhC6=4h0836-hg HTTP/1.1Host: www.jiltedowl.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=+OafPWEw6Z0Z/R6BCooy8AJa5dJFYQpN1/QWnuYdhiYhG0yayK8Tfl0bClCAF0vxrCxk&z6AhC6=4h0836-hg HTTP/1.1Host: www.slingshotart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=Yr1O9d2lyD9rL0BsR5AOXBjd9Tt7L5u6HmDWn6NeMbq+6FaKs7VlSuQ+xmgdPYl8Ubqc&z6AhC6=4h0836-hg HTTP/1.1Host: www.venturivasiljevic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=Xi9PH5iXPg7OqoK0h1gN6IvgnIc5gotQ/5tv039xv1j+fqecGtXMWbrdMdu22zA2SdJt&z6AhC6=4h0836-hg HTTP/1.1Host: www.helpushelpothersstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=xbMoviQlEnjsHrEbTPTiLAbjABxJdIVdbR0FO8anDWX5sWiRIQHIKvYrn6XTqKSl/tf+&z6AhC6=4h0836-hg HTTP/1.1Host: www.vicdux.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=jQU7CxI2ATQsp+gAQw0922hAeD0Z0/nKIEFQeuBuNEOev1XtQ7gaXUtk4Kl0GHqLnKhz&z6AhC6=4h0836-hg HTTP/1.1Host: www.lippocaritahotel.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=5AA2OBt9f+luPmvaEKU5k+Cesx0roAkoENQvosg49Q0qMzSHjZ+2qPqQ9q6NL9KFhBoB&z6AhC6=4h0836-hg HTTP/1.1Host: www.sitedesing.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=NkJAbAW12eli3K5LHnKsR+Euvd9TZZ9XHnn7bgS23Br3geXrqL1EBTSK/IXVH0nBwn3R&z6AhC6=4h0836-hg HTTP/1.1Host: www.themiamadison.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /um8e/?4h=OS+4PEF1Ll0k0ag4LLFRlEV4qtlkwOP7xXHx1u8kCQ7qmPGCq8FzaBf5dHjLd1oRWXdL&z6AhC6=4h0836-hg HTTP/1.1Host: www.influenced-brands.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.jiltedowl.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.21.0Date: Wed, 16 Jun 2021 09:56:58 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 315Connection: close

URLs found in memory or binary data

Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: RFQ-BCM 03122020.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: RFQ-BCM 03122020.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: http://sitedesing.com/404.html/index.xml
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: http://sitedesing.com/404/
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: http://sitedesing.com/images/Asset
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.278057340.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/lunr.js/0.7.2/lunr.min.js
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Source: chkdsk.exe, 0000000D.00000002.521332311.0000000005212000.00000004.00000001.sdmp	String found in binary or memory: https://opensource.keycdn.com/fontawesome/4.7.0/font-awesome.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_00404EB9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00404EB9

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004181C0 NtCreateFile,		3_2_004181C0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00418270 NtReadFile,		3_2_00418270
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004182F0 NtClose,		3_2_004182F0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004183A0 NtAllocateVirtualMemory,		3_2_004183A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041826D NtReadFile,		3_2_0041826D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004182EB NtClose,		3_2_004182EB
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041839A NtAllocateVirtualMemory,		3_2_0041839A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB98F0 NtReadVirtualMemory,LdrInitializeThunk,		3_2_00BB98F0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9860 NtQuerySystemInformation,LdrInitializeThunk,		3_2_00BB9860
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9840 NtDelayExecution,LdrInitializeThunk,		3_2_00BB9840
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB99A0 NtCreateSection,LdrInitializeThunk,		3_2_00BB99A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		3_2_00BB9910
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9A20 NtResumeThread,LdrInitializeThunk,		3_2_00BB9A20
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9A00 NtProtectVirtualMemory,LdrInitializeThunk,		3_2_00BB9A00
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9A50 NtCreateFile,LdrInitializeThunk,		3_2_00BB9A50
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB95D0 NtClose,LdrInitializeThunk,		3_2_00BB95D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9540 NtReadFile,LdrInitializeThunk,		3_2_00BB9540
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB96E0 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_00BB96E0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9660 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_00BB9660
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB97A0 NtUnmapViewOfSection,LdrInitializeThunk,		3_2_00BB97A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9780 NtMapViewOfSection,LdrInitializeThunk,		3_2_00BB9780
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9FE0 NtCreateMutant,LdrInitializeThunk,		3_2_00BB9FE0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9710 NtQueryInformationToken,LdrInitializeThunk,		3_2_00BB9710
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB98A0 NtWriteVirtualMemory,		3_2_00BB98A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9820 NtEnumerateKey,		3_2_00BB9820
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BBB040 NtSuspendThread,		3_2_00BBB040
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB99D0 NtCreateProcessEx,		3_2_00BB99D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9950 NtQueueApcThread,		3_2_00BB9950
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9A80 NtOpenDirectoryObject,		3_2_00BB9A80
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9A10 NtQuerySection,		3_2_00BB9A10
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BBA3B0 NtGetContextThread,		3_2_00BBA3B0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9B00 NtSetValueKey,		3_2_00BB9B00
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB95F0 NtQueryInformationFile,		3_2_00BB95F0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BBAD30 NtSetContextThread,		3_2_00BBAD30
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9520 NtWaitForSingleObject,		3_2_00BB9520
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9560 NtWriteFile,		3_2_00BB9560
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB96D0 NtCreateKey,		3_2_00BB96D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9610 NtEnumerateValueKey,		3_2_00BB9610
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9670 NtQueryInformationProcess,		3_2_00BB9670
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9650 NtQueryValueKey,		3_2_00BB9650
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9730 NtQueryVirtualMemory,		3_2_00BB9730
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BBA710 NtOpenProcessToken,		3_2_00BBA710
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9770 NtSetInformationFile,		3_2_00BB9770
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BBA770 NtOpenThread,		3_2_00BBA770
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB9760 NtOpenProcess,		3_2_00BB9760
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004181C0 NtCreateFile,		3_1_004181C0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00418270 NtReadFile,		3_1_00418270
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004182F0 NtClose,		3_1_004182F0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004183A0 NtAllocateVirtualMemory,		3_1_004183A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041826D NtReadFile,		3_1_0041826D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004182EB NtClose,		3_1_004182EB
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041839A NtAllocateVirtualMemory,		3_1_0041839A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC95D0 NtClose,LdrInitializeThunk,		13_2_04BC95D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9540 NtReadFile,LdrInitializeThunk,		13_2_04BC9540
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC96E0 NtFreeVirtualMemory,LdrInitializeThunk,		13_2_04BC96E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC96D0 NtCreateKey,LdrInitializeThunk,		13_2_04BC96D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9660 NtAllocateVirtualMemory,LdrInitializeThunk,		13_2_04BC9660
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9650 NtQueryValueKey,LdrInitializeThunk,		13_2_04BC9650
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9780 NtMapViewOfSection,LdrInitializeThunk,		13_2_04BC9780
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9FE0 NtCreateMutant,LdrInitializeThunk,		13_2_04BC9FE0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9710 NtQueryInformationToken,LdrInitializeThunk,		13_2_04BC9710
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9860 NtQuerySystemInformation,LdrInitializeThunk,		13_2_04BC9860
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9840 NtDelayExecution,LdrInitializeThunk,		13_2_04BC9840
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC99A0 NtCreateSection,LdrInitializeThunk,		13_2_04BC99A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		13_2_04BC9910
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9A50 NtCreateFile,LdrInitializeThunk,		13_2_04BC9A50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC95F0 NtQueryInformationFile,		13_2_04BC95F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BCAD30 NtSetContextThread,		13_2_04BCAD30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9520 NtWaitForSingleObject,		13_2_04BC9520
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9560 NtWriteFile,		13_2_04BC9560
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9610 NtEnumerateValueKey,		13_2_04BC9610
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9670 NtQueryInformationProcess,		13_2_04BC9670
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC97A0 NtUnmapViewOfSection,		13_2_04BC97A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9730 NtQueryVirtualMemory,		13_2_04BC9730
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BCA710 NtOpenProcessToken,		13_2_04BCA710
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BCA770 NtOpenThread,		13_2_04BCA770
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9770 NtSetInformationFile,		13_2_04BC9770
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9760 NtOpenProcess,		13_2_04BC9760
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC98A0 NtWriteVirtualMemory,		13_2_04BC98A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC98F0 NtReadVirtualMemory,		13_2_04BC98F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9820 NtEnumerateKey,		13_2_04BC9820
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BCB040 NtSuspendThread,		13_2_04BCB040
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC99D0 NtCreateProcessEx,		13_2_04BC99D0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9950 NtQueueApcThread,		13_2_04BC9950
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9A80 NtOpenDirectoryObject,		13_2_04BC9A80
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9A20 NtResumeThread,		13_2_04BC9A20
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9A10 NtQuerySection,		13_2_04BC9A10
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9A00 NtProtectVirtualMemory,		13_2_04BC9A00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BCA3B0 NtGetContextThread,		13_2_04BCA3B0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC9B00 NtSetValueKey,		13_2_04BC9B00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001381C0 NtCreateFile,		13_2_001381C0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_00138270 NtReadFile,		13_2_00138270
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001382F0 NtClose,		13_2_001382F0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001383A0 NtAllocateVirtualMemory,		13_2_001383A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013826D NtReadFile,		13_2_0013826D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001382EB NtClose,		13_2_001382EB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013839A NtAllocateVirtualMemory,		13_2_0013839A

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

2_2_004030CB

Detected potential crypto function

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_004046CA		2_2_004046CA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_00405FA8		2_2_00405FA8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_73431A98		2_2_73431A98
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00401030		3_2_00401030
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00401209		3_2_00401209
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041CAD7		3_2_0041CAD7
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041CADA		3_2_0041CADA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041BB43		3_2_0041BB43
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00408C60		3_2_00408C60
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041C4FA		3_2_0041C4FA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00402D90		3_2_00402D90
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041CF74		3_2_0041CF74
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041B7F3		3_2_0041B7F3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00402FB0		3_2_00402FB0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8B090		3_2_00B8B090
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C428EC		3_2_00C428EC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C420A8		3_2_00C420A8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A830		3_2_00B9A830
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31002		3_2_00C31002
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4E824		3_2_00C4E824
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7F900		3_2_00B7F900
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C422AE		3_2_00C422AE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2FA2B		3_2_00C2FA2B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAEBB0		3_2_00BAEBB0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3DBD2		3_2_00C3DBD2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C303DA		3_2_00C303DA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C223E3		3_2_00C223E3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAABD8		3_2_00BAABD8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C1CB4F		3_2_00C1CB4F
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C42B28		3_2_00C42B28
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AB40		3_2_00B9AB40
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3D466		3_2_00C3D466
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8841F		3_2_00B8841F
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C425DD		3_2_00C425DD
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2581		3_2_00BA2581
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8D5E0		3_2_00B8D5E0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C41D55		3_2_00C41D55
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B70D20		3_2_00B70D20
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C42D07		3_2_00C42D07
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C42EF7		3_2_00C42EF7
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B96E30		3_2_00B96E30
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3D616		3_2_00C3D616
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4DFCE		3_2_00C4DFCE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C41FF1		3_2_00C41FF1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00401030		3_1_00401030
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00401209		3_1_00401209
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041CAD7		3_1_0041CAD7
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041CADA		3_1_0041CADA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041BB43		3_1_0041BB43
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00408C60		3_1_00408C60
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041C4FA		3_1_0041C4FA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00402D90		3_1_00402D90
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041CF74		3_1_0041CF74
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041B7F3		3_1_0041B7F3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00402FB0		3_1_00402FB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4D466		13_2_04C4D466
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9841F		13_2_04B9841F
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C525DD		13_2_04C525DD
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB2581		13_2_04BB2581
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9D5E0		13_2_04B9D5E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C51D55		13_2_04C51D55
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B80D20		13_2_04B80D20
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C52D07		13_2_04C52D07
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C52EF7		13_2_04C52EF7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BA6E30		13_2_04BA6E30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4D616		13_2_04C4D616
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C5DFCE		13_2_04C5DFCE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C51FF1		13_2_04C51FF1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB20A0		13_2_04BB20A0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9B090		13_2_04B9B090
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C528EC		13_2_04C528EC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C520A8		13_2_04C520A8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41002		13_2_04C41002
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C5E824		13_2_04C5E824
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BA4120		13_2_04BA4120
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8F900		13_2_04B8F900
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C522AE		13_2_04C522AE
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C3FA2B		13_2_04C3FA2B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBEBB0		13_2_04BBEBB0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4DBD2		13_2_04C4DBD2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C403DA		13_2_04C403DA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C52B28		13_2_04C52B28
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAB40		13_2_04BAAB40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013CAD7		13_2_0013CAD7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013CADA		13_2_0013CADA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_00128C60		13_2_00128C60
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013C4FA		13_2_0013C4FA
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_00122D90		13_2_00122D90
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013CF74		13_2_0013CF74
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_00122FB0		13_2_00122FB0

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: String function: 04B8B150 appears 48 times
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: String function: 00B7B150 appears 136 times
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: String function: 0041A0A0 appears 38 times

Sample file is different than original file name gathered from version info

Source: RFQ-BCM 03122020.exe, 00000002.00000003.252302485.00000000099B6000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-BCM 03122020.exe
Source: RFQ-BCM 03122020.exe, 00000003.00000002.305155213.0000000000A46000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCHKDSK.EXEj% vs RFQ-BCM 03122020.exe
Source: RFQ-BCM 03122020.exe, 00000003.00000002.305433553.0000000000DFF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ-BCM 03122020.exe

Uses 32bit PE files

Source: RFQ-BCM 03122020.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@14/7

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_004041CD GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_004041CD

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_00402020 CoCreateInstance,MultiByteToWideChar,

2_2_00402020

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4972:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

File created: C:\Users\user\AppData\Local\Temp\nsuBF4A.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: RFQ-BCM 03122020.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: RFQ-BCM 03122020.exe	Virustotal: Detection: 20%
Source: RFQ-BCM 03122020.exe	ReversingLabs: Detection: 21%

Sample reads its own file content

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

File read: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\RFQ-BCM 03122020.exe 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process created: C:\Users\user\Desktop\RFQ-BCM 03122020.exe 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\chkdsk.exe C:\Windows\SysWOW64\chkdsk.exe
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process created: C:\Users\user\Desktop\RFQ-BCM 03122020.exe 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: chkdsk.pdbGCTL source: RFQ-BCM 03122020.exe, 00000003.00000002.305148472.0000000000A40000.00000040.00000001.sdmp
Source:	Binary string: chkdsk.pdb source: RFQ-BCM 03122020.exe, 00000003.00000002.305148472.0000000000A40000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RFQ-BCM 03122020.exe, 00000002.00000003.250609113.00000000098A0000.00000004.00000001.sdmp, RFQ-BCM 03122020.exe, 00000003.00000002.305161536.0000000000B50000.00000040.00000001.sdmp, chkdsk.exe, 0000000D.00000002.518417672.0000000004B60000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RFQ-BCM 03122020.exe, chkdsk.exe

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Unpacked PE file: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405CFF

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_73432F60 push eax; ret		2_2_73432F8E
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004160DB push ebx; iretd		3_2_004160DC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_004161D5 push esp; ret		3_2_004161D6
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041BB43 push dword ptr [353B5DC7h]; ret		3_2_0041BE43
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041C339 push esi; retf		3_2_0041C33A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041B3B5 push eax; ret		3_2_0041B408
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041B46C push eax; ret		3_2_0041B472
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041B402 push eax; ret		3_2_0041B408
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_0041B40B push eax; ret		3_2_0041B472
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00415EE1 push cs; iretd		3_2_00415EF8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BCD0D1 push ecx; ret		3_2_00BCD0E4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004160DB push ebx; iretd		3_1_004160DC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_004161D5 push esp; ret		3_1_004161D6
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041BB43 push dword ptr [353B5DC7h]; ret		3_1_0041BE43
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041C339 push esi; retf		3_1_0041C33A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041B3B5 push eax; ret		3_1_0041B408
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041B46C push eax; ret		3_1_0041B472
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041B402 push eax; ret		3_1_0041B408
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_0041B40B push eax; ret		3_1_0041B472
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_1_00415EE1 push cs; iretd		3_1_00415EF8
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BDD0D1 push ecx; ret		13_2_04BDD0E4
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001360DB push ebx; iretd		13_2_001360DC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_001361D5 push esp; ret		13_2_001361D6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013C339 push esi; retf		13_2_0013C33A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013B3B5 push eax; ret		13_2_0013B408
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013B402 push eax; ret		13_2_0013B408
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013B40B push eax; ret		13_2_0013B472
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013B46C push eax; ret		13_2_0013B472
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_0013BE38 push dword ptr [353B5DC7h]; ret		13_2_0013BE43
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_00135EE1 push cs; iretd		13_2_00135EF8

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

File created: C:\Users\user\AppData\Local\Temp\nsuBF4B.tmp\System.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 00000000001285E4 second address: 00000000001285EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\chkdsk.exe	RDTSC instruction interceptor: First address: 000000000012897E second address: 0000000000128984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 3_2_004088B0 rdtsc

3_2_004088B0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 1112	Thread sleep time: -55000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe TID: 1004	Thread sleep time: -42000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkdsk.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,		2_2_00405302
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_00405CD8 FindFirstFileA,FindClose,		2_2_00405CD8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 2_2_0040263E FindFirstFileA,		2_2_0040263E

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000000.274241173.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.263827938.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.273883653.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.289137714.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000000.287405384.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000004.00000000.274720309.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000004.00000000.296397511.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000004.00000000.273883653.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.273883653.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.274720309.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: explorer.exe, 00000004.00000000.273883653.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 3_2_004088B0 rdtsc

3_2_004088B0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 3_2_00409B20 LdrLoadDll,

3_2_00409B20

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405CFF

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAF0BF mov ecx, dword ptr fs:[00000030h]		3_2_00BAF0BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAF0BF mov eax, dword ptr fs:[00000030h]		3_2_00BAF0BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAF0BF mov eax, dword ptr fs:[00000030h]		3_2_00BAF0BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov ecx, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00C0B8D0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB90AF mov eax, dword ptr fs:[00000030h]		3_2_00BB90AF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA20A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA20A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79080 mov eax, dword ptr fs:[00000030h]		3_2_00B79080
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF3884 mov eax, dword ptr fs:[00000030h]		3_2_00BF3884
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF3884 mov eax, dword ptr fs:[00000030h]		3_2_00BF3884
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B740E1 mov eax, dword ptr fs:[00000030h]		3_2_00B740E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B740E1 mov eax, dword ptr fs:[00000030h]		3_2_00B740E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B740E1 mov eax, dword ptr fs:[00000030h]		3_2_00B740E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B758EC mov eax, dword ptr fs:[00000030h]		3_2_00B758EC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B8E4 mov eax, dword ptr fs:[00000030h]		3_2_00B9B8E4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B8E4 mov eax, dword ptr fs:[00000030h]		3_2_00B9B8E4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A830 mov eax, dword ptr fs:[00000030h]		3_2_00B9A830
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A830 mov eax, dword ptr fs:[00000030h]		3_2_00B9A830
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A830 mov eax, dword ptr fs:[00000030h]		3_2_00B9A830
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A830 mov eax, dword ptr fs:[00000030h]		3_2_00B9A830
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8B02A mov eax, dword ptr fs:[00000030h]		3_2_00B8B02A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8B02A mov eax, dword ptr fs:[00000030h]		3_2_00B8B02A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8B02A mov eax, dword ptr fs:[00000030h]		3_2_00B8B02A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8B02A mov eax, dword ptr fs:[00000030h]		3_2_00B8B02A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA002D mov eax, dword ptr fs:[00000030h]		3_2_00BA002D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA002D mov eax, dword ptr fs:[00000030h]		3_2_00BA002D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA002D mov eax, dword ptr fs:[00000030h]		3_2_00BA002D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA002D mov eax, dword ptr fs:[00000030h]		3_2_00BA002D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA002D mov eax, dword ptr fs:[00000030h]		3_2_00BA002D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7016 mov eax, dword ptr fs:[00000030h]		3_2_00BF7016
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7016 mov eax, dword ptr fs:[00000030h]		3_2_00BF7016
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7016 mov eax, dword ptr fs:[00000030h]		3_2_00BF7016
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32073 mov eax, dword ptr fs:[00000030h]		3_2_00C32073
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C41074 mov eax, dword ptr fs:[00000030h]		3_2_00C41074
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C44015 mov eax, dword ptr fs:[00000030h]		3_2_00C44015
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C44015 mov eax, dword ptr fs:[00000030h]		3_2_00C44015
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B90050 mov eax, dword ptr fs:[00000030h]		3_2_00B90050
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B90050 mov eax, dword ptr fs:[00000030h]		3_2_00B90050
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF51BE mov eax, dword ptr fs:[00000030h]		3_2_00BF51BE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF51BE mov eax, dword ptr fs:[00000030h]		3_2_00BF51BE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF51BE mov eax, dword ptr fs:[00000030h]		3_2_00BF51BE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF51BE mov eax, dword ptr fs:[00000030h]		3_2_00BF51BE
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov eax, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov eax, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov eax, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov ecx, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B999BF mov eax, dword ptr fs:[00000030h]		3_2_00B999BF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF69A6 mov eax, dword ptr fs:[00000030h]		3_2_00BF69A6
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA61A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA61A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA61A0 mov eax, dword ptr fs:[00000030h]		3_2_00BA61A0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C041E8 mov eax, dword ptr fs:[00000030h]		3_2_00C041E8
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2990 mov eax, dword ptr fs:[00000030h]		3_2_00BA2990
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9C182 mov eax, dword ptr fs:[00000030h]		3_2_00B9C182
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA185 mov eax, dword ptr fs:[00000030h]		3_2_00BAA185
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7B1E1 mov eax, dword ptr fs:[00000030h]		3_2_00B7B1E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7B1E1 mov eax, dword ptr fs:[00000030h]		3_2_00B7B1E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7B1E1 mov eax, dword ptr fs:[00000030h]		3_2_00B7B1E1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C349A4 mov eax, dword ptr fs:[00000030h]		3_2_00C349A4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C349A4 mov eax, dword ptr fs:[00000030h]		3_2_00C349A4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C349A4 mov eax, dword ptr fs:[00000030h]		3_2_00C349A4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C349A4 mov eax, dword ptr fs:[00000030h]		3_2_00C349A4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA513A mov eax, dword ptr fs:[00000030h]		3_2_00BA513A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA513A mov eax, dword ptr fs:[00000030h]		3_2_00BA513A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120 mov eax, dword ptr fs:[00000030h]		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120 mov eax, dword ptr fs:[00000030h]		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120 mov eax, dword ptr fs:[00000030h]		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120 mov eax, dword ptr fs:[00000030h]		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B94120 mov ecx, dword ptr fs:[00000030h]		3_2_00B94120
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79100 mov eax, dword ptr fs:[00000030h]		3_2_00B79100
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79100 mov eax, dword ptr fs:[00000030h]		3_2_00B79100
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79100 mov eax, dword ptr fs:[00000030h]		3_2_00B79100
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7B171 mov eax, dword ptr fs:[00000030h]		3_2_00B7B171
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7B171 mov eax, dword ptr fs:[00000030h]		3_2_00B7B171
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7C962 mov eax, dword ptr fs:[00000030h]		3_2_00B7C962
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B944 mov eax, dword ptr fs:[00000030h]		3_2_00B9B944
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B944 mov eax, dword ptr fs:[00000030h]		3_2_00B9B944
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8AAB0 mov eax, dword ptr fs:[00000030h]		3_2_00B8AAB0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8AAB0 mov eax, dword ptr fs:[00000030h]		3_2_00B8AAB0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAFAB0 mov eax, dword ptr fs:[00000030h]		3_2_00BAFAB0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B752A5 mov eax, dword ptr fs:[00000030h]		3_2_00B752A5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B752A5 mov eax, dword ptr fs:[00000030h]		3_2_00B752A5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B752A5 mov eax, dword ptr fs:[00000030h]		3_2_00B752A5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B752A5 mov eax, dword ptr fs:[00000030h]		3_2_00B752A5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B752A5 mov eax, dword ptr fs:[00000030h]		3_2_00B752A5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34AEF mov eax, dword ptr fs:[00000030h]		3_2_00C34AEF
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAD294 mov eax, dword ptr fs:[00000030h]		3_2_00BAD294
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAD294 mov eax, dword ptr fs:[00000030h]		3_2_00BAD294
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2AE4 mov eax, dword ptr fs:[00000030h]		3_2_00BA2AE4
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2ACB mov eax, dword ptr fs:[00000030h]		3_2_00BA2ACB
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A229 mov eax, dword ptr fs:[00000030h]		3_2_00B9A229
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3EA55 mov eax, dword ptr fs:[00000030h]		3_2_00C3EA55
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C04257 mov eax, dword ptr fs:[00000030h]		3_2_00C04257
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB4A2C mov eax, dword ptr fs:[00000030h]		3_2_00BB4A2C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB4A2C mov eax, dword ptr fs:[00000030h]		3_2_00BB4A2C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7AA16 mov eax, dword ptr fs:[00000030h]		3_2_00B7AA16
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7AA16 mov eax, dword ptr fs:[00000030h]		3_2_00B7AA16
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2B260 mov eax, dword ptr fs:[00000030h]		3_2_00C2B260
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2B260 mov eax, dword ptr fs:[00000030h]		3_2_00C2B260
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B93A1C mov eax, dword ptr fs:[00000030h]		3_2_00B93A1C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48A62 mov eax, dword ptr fs:[00000030h]		3_2_00C48A62
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B75210 mov eax, dword ptr fs:[00000030h]		3_2_00B75210
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B75210 mov ecx, dword ptr fs:[00000030h]		3_2_00B75210
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B75210 mov eax, dword ptr fs:[00000030h]		3_2_00B75210
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B75210 mov eax, dword ptr fs:[00000030h]		3_2_00B75210
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B88A0A mov eax, dword ptr fs:[00000030h]		3_2_00B88A0A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB927A mov eax, dword ptr fs:[00000030h]		3_2_00BB927A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3AA16 mov eax, dword ptr fs:[00000030h]		3_2_00C3AA16
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3AA16 mov eax, dword ptr fs:[00000030h]		3_2_00C3AA16
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79240 mov eax, dword ptr fs:[00000030h]		3_2_00B79240
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79240 mov eax, dword ptr fs:[00000030h]		3_2_00B79240
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79240 mov eax, dword ptr fs:[00000030h]		3_2_00B79240
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B79240 mov eax, dword ptr fs:[00000030h]		3_2_00B79240
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4BAD mov eax, dword ptr fs:[00000030h]		3_2_00BA4BAD
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4BAD mov eax, dword ptr fs:[00000030h]		3_2_00BA4BAD
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4BAD mov eax, dword ptr fs:[00000030h]		3_2_00BA4BAD
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C223E3 mov ecx, dword ptr fs:[00000030h]		3_2_00C223E3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C223E3 mov ecx, dword ptr fs:[00000030h]		3_2_00C223E3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C223E3 mov eax, dword ptr fs:[00000030h]		3_2_00C223E3
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAB390 mov eax, dword ptr fs:[00000030h]		3_2_00BAB390
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2397 mov eax, dword ptr fs:[00000030h]		3_2_00BA2397
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B81B8F mov eax, dword ptr fs:[00000030h]		3_2_00B81B8F
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B81B8F mov eax, dword ptr fs:[00000030h]		3_2_00B81B8F
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2D380 mov ecx, dword ptr fs:[00000030h]		3_2_00C2D380
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3138A mov eax, dword ptr fs:[00000030h]		3_2_00C3138A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9DBE9 mov eax, dword ptr fs:[00000030h]		3_2_00B9DBE9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA03E2 mov eax, dword ptr fs:[00000030h]		3_2_00BA03E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C45BA5 mov eax, dword ptr fs:[00000030h]		3_2_00C45BA5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF53CA mov eax, dword ptr fs:[00000030h]		3_2_00BF53CA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF53CA mov eax, dword ptr fs:[00000030h]		3_2_00BF53CA
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48B58 mov eax, dword ptr fs:[00000030h]		3_2_00C48B58
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9A309 mov eax, dword ptr fs:[00000030h]		3_2_00B9A309
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA3B7A mov eax, dword ptr fs:[00000030h]		3_2_00BA3B7A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA3B7A mov eax, dword ptr fs:[00000030h]		3_2_00BA3B7A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7DB60 mov ecx, dword ptr fs:[00000030h]		3_2_00B7DB60
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3131B mov eax, dword ptr fs:[00000030h]		3_2_00C3131B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7F358 mov eax, dword ptr fs:[00000030h]		3_2_00B7F358
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7DB40 mov eax, dword ptr fs:[00000030h]		3_2_00B7DB40
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48CD6 mov eax, dword ptr fs:[00000030h]		3_2_00C48CD6
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8849B mov eax, dword ptr fs:[00000030h]		3_2_00B8849B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C314FB mov eax, dword ptr fs:[00000030h]		3_2_00C314FB
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6CF0 mov eax, dword ptr fs:[00000030h]		3_2_00BF6CF0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6CF0 mov eax, dword ptr fs:[00000030h]		3_2_00BF6CF0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6CF0 mov eax, dword ptr fs:[00000030h]		3_2_00BF6CF0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C34496 mov eax, dword ptr fs:[00000030h]		3_2_00C34496
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0C450 mov eax, dword ptr fs:[00000030h]		3_2_00C0C450
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0C450 mov eax, dword ptr fs:[00000030h]		3_2_00C0C450
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BABC2C mov eax, dword ptr fs:[00000030h]		3_2_00BABC2C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6C0A mov eax, dword ptr fs:[00000030h]		3_2_00BF6C0A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6C0A mov eax, dword ptr fs:[00000030h]		3_2_00BF6C0A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6C0A mov eax, dword ptr fs:[00000030h]		3_2_00BF6C0A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6C0A mov eax, dword ptr fs:[00000030h]		3_2_00BF6C0A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAAC7B mov eax, dword ptr fs:[00000030h]		3_2_00BAAC7B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31C06 mov eax, dword ptr fs:[00000030h]		3_2_00C31C06
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4740D mov eax, dword ptr fs:[00000030h]		3_2_00C4740D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4740D mov eax, dword ptr fs:[00000030h]		3_2_00C4740D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4740D mov eax, dword ptr fs:[00000030h]		3_2_00C4740D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B477 mov eax, dword ptr fs:[00000030h]		3_2_00B9B477
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9746D mov eax, dword ptr fs:[00000030h]		3_2_00B9746D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA44B mov eax, dword ptr fs:[00000030h]		3_2_00BAA44B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00BA1DB5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00BA1DB5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00BA1DB5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA35A1 mov eax, dword ptr fs:[00000030h]		3_2_00BA35A1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAFD9B mov eax, dword ptr fs:[00000030h]		3_2_00BAFD9B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAFD9B mov eax, dword ptr fs:[00000030h]		3_2_00BAFD9B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00C3FDE2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00C3FDE2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00C3FDE2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00C3FDE2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C28DF1 mov eax, dword ptr fs:[00000030h]		3_2_00C28DF1
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2581 mov eax, dword ptr fs:[00000030h]		3_2_00BA2581
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2581 mov eax, dword ptr fs:[00000030h]		3_2_00BA2581
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2581 mov eax, dword ptr fs:[00000030h]		3_2_00BA2581
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA2581 mov eax, dword ptr fs:[00000030h]		3_2_00BA2581
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B72D8A mov eax, dword ptr fs:[00000030h]		3_2_00B72D8A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B72D8A mov eax, dword ptr fs:[00000030h]		3_2_00B72D8A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B72D8A mov eax, dword ptr fs:[00000030h]		3_2_00B72D8A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B72D8A mov eax, dword ptr fs:[00000030h]		3_2_00B72D8A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B72D8A mov eax, dword ptr fs:[00000030h]		3_2_00B72D8A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C32D82 mov eax, dword ptr fs:[00000030h]		3_2_00C32D82
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8D5E0 mov eax, dword ptr fs:[00000030h]		3_2_00B8D5E0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8D5E0 mov eax, dword ptr fs:[00000030h]		3_2_00B8D5E0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C405AC mov eax, dword ptr fs:[00000030h]		3_2_00C405AC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C405AC mov eax, dword ptr fs:[00000030h]		3_2_00C405AC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov eax, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov eax, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov eax, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov ecx, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov eax, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF6DC9 mov eax, dword ptr fs:[00000030h]		3_2_00BF6DC9
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4D3B mov eax, dword ptr fs:[00000030h]		3_2_00BA4D3B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4D3B mov eax, dword ptr fs:[00000030h]		3_2_00BA4D3B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA4D3B mov eax, dword ptr fs:[00000030h]		3_2_00BA4D3B
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C23D40 mov eax, dword ptr fs:[00000030h]		3_2_00C23D40
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7AD30 mov eax, dword ptr fs:[00000030h]		3_2_00B7AD30
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BFA537 mov eax, dword ptr fs:[00000030h]		3_2_00BFA537
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B83D34 mov eax, dword ptr fs:[00000030h]		3_2_00B83D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9C577 mov eax, dword ptr fs:[00000030h]		3_2_00B9C577
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9C577 mov eax, dword ptr fs:[00000030h]		3_2_00B9C577
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B97D50 mov eax, dword ptr fs:[00000030h]		3_2_00B97D50
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48D34 mov eax, dword ptr fs:[00000030h]		3_2_00C48D34
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB3D43 mov eax, dword ptr fs:[00000030h]		3_2_00BB3D43
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3E539 mov eax, dword ptr fs:[00000030h]		3_2_00C3E539
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF3540 mov eax, dword ptr fs:[00000030h]		3_2_00BF3540
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2FEC0 mov eax, dword ptr fs:[00000030h]		3_2_00C2FEC0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48ED6 mov eax, dword ptr fs:[00000030h]		3_2_00C48ED6
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF46A7 mov eax, dword ptr fs:[00000030h]		3_2_00BF46A7
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0FE87 mov eax, dword ptr fs:[00000030h]		3_2_00C0FE87
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA16E0 mov ecx, dword ptr fs:[00000030h]		3_2_00BA16E0
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B876E2 mov eax, dword ptr fs:[00000030h]		3_2_00B876E2
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C40EA5 mov eax, dword ptr fs:[00000030h]		3_2_00C40EA5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C40EA5 mov eax, dword ptr fs:[00000030h]		3_2_00C40EA5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C40EA5 mov eax, dword ptr fs:[00000030h]		3_2_00C40EA5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA36CC mov eax, dword ptr fs:[00000030h]		3_2_00BA36CC
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB8EC7 mov eax, dword ptr fs:[00000030h]		3_2_00BB8EC7
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3AE44 mov eax, dword ptr fs:[00000030h]		3_2_00C3AE44
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C3AE44 mov eax, dword ptr fs:[00000030h]		3_2_00C3AE44
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7E620 mov eax, dword ptr fs:[00000030h]		3_2_00B7E620
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA61C mov eax, dword ptr fs:[00000030h]		3_2_00BAA61C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA61C mov eax, dword ptr fs:[00000030h]		3_2_00BAA61C
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7C600 mov eax, dword ptr fs:[00000030h]		3_2_00B7C600
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7C600 mov eax, dword ptr fs:[00000030h]		3_2_00B7C600
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B7C600 mov eax, dword ptr fs:[00000030h]		3_2_00B7C600
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BA8E00 mov eax, dword ptr fs:[00000030h]		3_2_00BA8E00
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AE73 mov eax, dword ptr fs:[00000030h]		3_2_00B9AE73
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AE73 mov eax, dword ptr fs:[00000030h]		3_2_00B9AE73
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AE73 mov eax, dword ptr fs:[00000030h]		3_2_00B9AE73
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AE73 mov eax, dword ptr fs:[00000030h]		3_2_00B9AE73
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9AE73 mov eax, dword ptr fs:[00000030h]		3_2_00B9AE73
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C31608 mov eax, dword ptr fs:[00000030h]		3_2_00C31608
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8766D mov eax, dword ptr fs:[00000030h]		3_2_00B8766D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B87E41 mov eax, dword ptr fs:[00000030h]		3_2_00B87E41
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C2FE3F mov eax, dword ptr fs:[00000030h]		3_2_00C2FE3F
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7794 mov eax, dword ptr fs:[00000030h]		3_2_00BF7794
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7794 mov eax, dword ptr fs:[00000030h]		3_2_00BF7794
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BF7794 mov eax, dword ptr fs:[00000030h]		3_2_00BF7794
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B88794 mov eax, dword ptr fs:[00000030h]		3_2_00B88794
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BB37F5 mov eax, dword ptr fs:[00000030h]		3_2_00BB37F5
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B73D mov eax, dword ptr fs:[00000030h]		3_2_00B9B73D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9B73D mov eax, dword ptr fs:[00000030h]		3_2_00B9B73D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAE730 mov eax, dword ptr fs:[00000030h]		3_2_00BAE730
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B74F2E mov eax, dword ptr fs:[00000030h]		3_2_00B74F2E
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B74F2E mov eax, dword ptr fs:[00000030h]		3_2_00B74F2E
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C48F6A mov eax, dword ptr fs:[00000030h]		3_2_00C48F6A
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B9F716 mov eax, dword ptr fs:[00000030h]		3_2_00B9F716
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA70E mov eax, dword ptr fs:[00000030h]		3_2_00BAA70E
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00BAA70E mov eax, dword ptr fs:[00000030h]		3_2_00BAA70E
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4070D mov eax, dword ptr fs:[00000030h]		3_2_00C4070D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C4070D mov eax, dword ptr fs:[00000030h]		3_2_00C4070D
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0FF10 mov eax, dword ptr fs:[00000030h]		3_2_00C0FF10
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00C0FF10 mov eax, dword ptr fs:[00000030h]		3_2_00C0FF10
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8FF60 mov eax, dword ptr fs:[00000030h]		3_2_00B8FF60
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Code function: 3_2_00B8EF40 mov eax, dword ptr fs:[00000030h]		3_2_00B8EF40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C58CD6 mov eax, dword ptr fs:[00000030h]		13_2_04C58CD6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9849B mov eax, dword ptr fs:[00000030h]		13_2_04B9849B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06CF0 mov eax, dword ptr fs:[00000030h]		13_2_04C06CF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06CF0 mov eax, dword ptr fs:[00000030h]		13_2_04C06CF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06CF0 mov eax, dword ptr fs:[00000030h]		13_2_04C06CF0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C414FB mov eax, dword ptr fs:[00000030h]		13_2_04C414FB
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C1C450 mov eax, dword ptr fs:[00000030h]		13_2_04C1C450
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C1C450 mov eax, dword ptr fs:[00000030h]		13_2_04C1C450
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBBC2C mov eax, dword ptr fs:[00000030h]		13_2_04BBBC2C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41C06 mov eax, dword ptr fs:[00000030h]		13_2_04C41C06
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C5740D mov eax, dword ptr fs:[00000030h]		13_2_04C5740D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C5740D mov eax, dword ptr fs:[00000030h]		13_2_04C5740D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C5740D mov eax, dword ptr fs:[00000030h]		13_2_04C5740D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06C0A mov eax, dword ptr fs:[00000030h]		13_2_04C06C0A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06C0A mov eax, dword ptr fs:[00000030h]		13_2_04C06C0A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06C0A mov eax, dword ptr fs:[00000030h]		13_2_04C06C0A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06C0A mov eax, dword ptr fs:[00000030h]		13_2_04C06C0A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BA746D mov eax, dword ptr fs:[00000030h]		13_2_04BA746D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBA44B mov eax, dword ptr fs:[00000030h]		13_2_04BBA44B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov eax, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov eax, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov eax, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov ecx, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov eax, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C06DC9 mov eax, dword ptr fs:[00000030h]		13_2_04C06DC9
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB1DB5 mov eax, dword ptr fs:[00000030h]		13_2_04BB1DB5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB1DB5 mov eax, dword ptr fs:[00000030h]		13_2_04BB1DB5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB1DB5 mov eax, dword ptr fs:[00000030h]		13_2_04BB1DB5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB35A1 mov eax, dword ptr fs:[00000030h]		13_2_04BB35A1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBFD9B mov eax, dword ptr fs:[00000030h]		13_2_04BBFD9B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBFD9B mov eax, dword ptr fs:[00000030h]		13_2_04BBFD9B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4FDE2 mov eax, dword ptr fs:[00000030h]		13_2_04C4FDE2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4FDE2 mov eax, dword ptr fs:[00000030h]		13_2_04C4FDE2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4FDE2 mov eax, dword ptr fs:[00000030h]		13_2_04C4FDE2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4FDE2 mov eax, dword ptr fs:[00000030h]		13_2_04C4FDE2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C38DF1 mov eax, dword ptr fs:[00000030h]		13_2_04C38DF1
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B82D8A mov eax, dword ptr fs:[00000030h]		13_2_04B82D8A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B82D8A mov eax, dword ptr fs:[00000030h]		13_2_04B82D8A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B82D8A mov eax, dword ptr fs:[00000030h]		13_2_04B82D8A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B82D8A mov eax, dword ptr fs:[00000030h]		13_2_04B82D8A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B82D8A mov eax, dword ptr fs:[00000030h]		13_2_04B82D8A
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB2581 mov eax, dword ptr fs:[00000030h]		13_2_04BB2581
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB2581 mov eax, dword ptr fs:[00000030h]		13_2_04BB2581
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB2581 mov eax, dword ptr fs:[00000030h]		13_2_04BB2581
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB2581 mov eax, dword ptr fs:[00000030h]		13_2_04BB2581
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9D5E0 mov eax, dword ptr fs:[00000030h]		13_2_04B9D5E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9D5E0 mov eax, dword ptr fs:[00000030h]		13_2_04B9D5E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C505AC mov eax, dword ptr fs:[00000030h]		13_2_04C505AC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C505AC mov eax, dword ptr fs:[00000030h]		13_2_04C505AC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB4D3B mov eax, dword ptr fs:[00000030h]		13_2_04BB4D3B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB4D3B mov eax, dword ptr fs:[00000030h]		13_2_04BB4D3B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB4D3B mov eax, dword ptr fs:[00000030h]		13_2_04BB4D3B
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C03540 mov eax, dword ptr fs:[00000030h]		13_2_04C03540
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C33D40 mov eax, dword ptr fs:[00000030h]		13_2_04C33D40
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8AD30 mov eax, dword ptr fs:[00000030h]		13_2_04B8AD30
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B93D34 mov eax, dword ptr fs:[00000030h]		13_2_04B93D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAC577 mov eax, dword ptr fs:[00000030h]		13_2_04BAC577
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAC577 mov eax, dword ptr fs:[00000030h]		13_2_04BAC577
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BA7D50 mov eax, dword ptr fs:[00000030h]		13_2_04BA7D50
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C58D34 mov eax, dword ptr fs:[00000030h]		13_2_04C58D34
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C0A537 mov eax, dword ptr fs:[00000030h]		13_2_04C0A537
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4E539 mov eax, dword ptr fs:[00000030h]		13_2_04C4E539
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC3D43 mov eax, dword ptr fs:[00000030h]		13_2_04BC3D43
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C3FEC0 mov eax, dword ptr fs:[00000030h]		13_2_04C3FEC0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C58ED6 mov eax, dword ptr fs:[00000030h]		13_2_04C58ED6
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C1FE87 mov eax, dword ptr fs:[00000030h]		13_2_04C1FE87
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB16E0 mov ecx, dword ptr fs:[00000030h]		13_2_04BB16E0
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B976E2 mov eax, dword ptr fs:[00000030h]		13_2_04B976E2
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C50EA5 mov eax, dword ptr fs:[00000030h]		13_2_04C50EA5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C50EA5 mov eax, dword ptr fs:[00000030h]		13_2_04C50EA5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C50EA5 mov eax, dword ptr fs:[00000030h]		13_2_04C50EA5
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C046A7 mov eax, dword ptr fs:[00000030h]		13_2_04C046A7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB36CC mov eax, dword ptr fs:[00000030h]		13_2_04BB36CC
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BC8EC7 mov eax, dword ptr fs:[00000030h]		13_2_04BC8EC7
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4AE44 mov eax, dword ptr fs:[00000030h]		13_2_04C4AE44
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C4AE44 mov eax, dword ptr fs:[00000030h]		13_2_04C4AE44
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8E620 mov eax, dword ptr fs:[00000030h]		13_2_04B8E620
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBA61C mov eax, dword ptr fs:[00000030h]		13_2_04BBA61C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BBA61C mov eax, dword ptr fs:[00000030h]		13_2_04BBA61C
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8C600 mov eax, dword ptr fs:[00000030h]		13_2_04B8C600
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8C600 mov eax, dword ptr fs:[00000030h]		13_2_04B8C600
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B8C600 mov eax, dword ptr fs:[00000030h]		13_2_04B8C600
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BB8E00 mov eax, dword ptr fs:[00000030h]		13_2_04BB8E00
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAE73 mov eax, dword ptr fs:[00000030h]		13_2_04BAAE73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAE73 mov eax, dword ptr fs:[00000030h]		13_2_04BAAE73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAE73 mov eax, dword ptr fs:[00000030h]		13_2_04BAAE73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAE73 mov eax, dword ptr fs:[00000030h]		13_2_04BAAE73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04BAAE73 mov eax, dword ptr fs:[00000030h]		13_2_04BAAE73
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04C41608 mov eax, dword ptr fs:[00000030h]		13_2_04C41608
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B9766D mov eax, dword ptr fs:[00000030h]		13_2_04B9766D
Source: C:\Windows\SysWOW64\chkdsk.exe	Code function: 13_2_04B97E41 mov eax, dword ptr fs:[00000030h]		13_2_04B97E41

Enables debug privileges

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 100.24.208.97 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.venturivasiljevic.com
Source: C:\Windows\explorer.exe	Domain query: www.lippocaritahotel.com
Source: C:\Windows\explorer.exe	Domain query: www.jiltedowl.com
Source: C:\Windows\explorer.exe	Domain query: www.influenced-brands.com
Source: C:\Windows\explorer.exe	Domain query: www.vicdux.life
Source: C:\Windows\explorer.exe	Network Connect: 172.67.193.107 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.themiamadison.com
Source: C:\Windows\explorer.exe	Domain query: www.top1opp.com
Source: C:\Windows\explorer.exe	Network Connect: 44.227.65.245 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.24 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 103.28.148.178 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.slingshotart.com
Source: C:\Windows\explorer.exe	Domain query: www.yorkshirebridalmakeup.info
Source: C:\Windows\explorer.exe	Domain query: www.sitedesing.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.216.127.214 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.helpushelpothersstore.com
Source: C:\Windows\explorer.exe	Domain query: www.saddletaxweigh.info

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Section loaded: unknown target: C:\Users\user\Desktop\RFQ-BCM 03122020.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Section loaded: unknown target: C:\Windows\SysWOW64\chkdsk.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Thread register set: target process: 3472			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Thread register set: target process: 3472			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Section unmapped: C:\Windows\SysWOW64\chkdsk.exe base address: 200000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe	Process created: C:\Users\user\Desktop\RFQ-BCM 03122020.exe 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\chkdsk.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RFQ-BCM 03122020.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000000.269921839.0000000005EA0000.00000004.00000001.sdmp, chkdsk.exe, 0000000D.00000002.521588226.0000000007180000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.260542390.0000000001640000.00000002.00000001.sdmp, chkdsk.exe, 0000000D.00000002.521588226.0000000007180000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.260542390.0000000001640000.00000002.00000001.sdmp, chkdsk.exe, 0000000D.00000002.521588226.0000000007180000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000004.00000000.287343246.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000004.00000000.260542390.0000000001640000.00000002.00000001.sdmp, chkdsk.exe, 0000000D.00000002.521588226.0000000007180000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000004.00000000.260542390.0000000001640000.00000002.00000001.sdmp, chkdsk.exe, 0000000D.00000002.521588226.0000000007180000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query windows version

Source: C:\Users\user\Desktop\RFQ-BCM 03122020.exe

Code function: 2_2_004059FF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_004059FF

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 0000000D.00000002.517395311.0000000004320000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304999072.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000001.254539209.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.304861461.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.517835626.00000000047A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.257817339.0000000002160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.516326886.0000000000120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305023643.00000000006D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RFQ-BCM 03122020.exe.2160000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RFQ-BCM 03122020.exe.400000.0.raw.unpack, type: UNPACKEDPE