Windows Analysis Report
Request for Tender Quotation.exe

Overview

General Information

Sample name: Request for Tender Quotation.exe
Analysis ID: 1516760
MD5: 86d8eb475db8a7b47c95238a32176b8c
SHA1: 0c002a06936084477f6a5e9ac61ce5273881f2db
SHA256: 55dd90013201853f29bb56e9e832f1a6483da1d154e500b7d08c86335e7f037b
Tags: exeRedLineStealer
Infos:

Detection

RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected RedLine Stealer
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Request for Tender Quotation.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Avira: detection malicious, Label: HEUR/AGEN.1306777
Found malware configuration
Source: 0.2.Request for Tender Quotation.exe.43b9860.3.raw.unpack Malware Configuration Extractor: RedLine {"C2 url": ["198.12.90.244:49780"], "Bot Id": "success", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: Request for Tender Quotation.exe ReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Request for Tender Quotation.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Request for Tender Quotation.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Request for Tender Quotation.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.00000000018CB000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001594000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb0 source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001901000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001586000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdbY source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001594000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 4x nop then jmp 0777BDEBh 0_2_0777BEFD
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 4x nop then jmp 0763B053h 11_2_0763B165

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 198.12.90.244:49780
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 198.12.90.244 ports 0,4,7,8,9,49780
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49732 -> 198.12.90.244:49780
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.90.244
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Request for Tender Quotation.exe, 00000000.00000002.2210989615.0000000003324000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000B.00000002.2291032391.0000000003054000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003291000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000357C000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000352E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000034DF000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003668000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000361A000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000035CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Ent
Source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000035CB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003755000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000033F3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003490000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003442000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000036B7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037F5000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.00000000037A3000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003892000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003843000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9LR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003653000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AF2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000037DC000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000387A000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003B41000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000035FE000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000373F000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000378E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000039B5000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000034F1000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003917000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003AA3000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A03000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000036A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003A55000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3426922416.0000000003966000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.000000000339E000.00000004.00000800.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3425316831.0000000003706000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.00000000043A2000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 00000000.00000002.2212400913.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 00000000.00000002.2212400913.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 0000000A.00000002.3422027027.0000000000425000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Request for Tender Quotation.exe
Detected potential crypto function
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_01434238 0_2_01434238
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_01437291 0_2_01437291
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07771B00 0_2_07771B00
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_077729F0 0_2_077729F0
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07775628 0_2_07775628
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07775618 0_2_07775618
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07777540 0_2_07777540
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_0777753F 0_2_0777753F
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07777108 0_2_07777108
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_077770F9 0_2_077770F9
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07777EF0 0_2_07777EF0
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07774A78 0_2_07774A78
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_07775A60 0_2_07775A60
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_077729E1 0_2_077729E1
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_0777D87C 0_2_0777D87C
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 10_2_016FDC74 10_2_016FDC74
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_01474238 11_2_01474238
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_01477291 11_2_01477291
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054D0D58 11_2_054D0D58
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054D1708 11_2_054D1708
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054D1718 11_2_054D1718
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07631B00 11_2_07631B00
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_076329F0 11_2_076329F0
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07635628 11_2_07635628
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07635618 11_2_07635618
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07637540 11_2_07637540
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_0763753F 11_2_0763753F
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07637108 11_2_07637108
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_076370F9 11_2_076370F9
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07637EF0 11_2_07637EF0
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07635A60 11_2_07635A60
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07634A78 11_2_07634A78
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07635A50 11_2_07635A50
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_076329E1 11_2_076329E1
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_0763C984 11_2_0763C984
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_07632990 11_2_07632990
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_0187DC74 15_2_0187DC74
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057CEE58 15_2_057CEE58
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057C8850 15_2_057C8850
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057C0040 15_2_057C0040
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057C001B 15_2_057C001B
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057C8840 15_2_057C8840
Sample file is different than original file name gathered from version info
Source: Request for Tender Quotation.exe, 00000000.00000002.2210989615.00000000032D1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.00000000043A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSteanings.exe8 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000000.2157410145.0000000000CD2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamewEdG.exe4 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.000000000457E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSteanings.exe8 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.000000000457E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2218178464.0000000008710000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.00000000043ED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSteanings.exe8 vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe, 00000000.00000002.2209099163.000000000144E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Request for Tender Quotation.exe
Source: Request for Tender Quotation.exe Binary or memory string: OriginalFilenamewEdG.exe4 vs Request for Tender Quotation.exe
Uses 32bit PE files
Source: Request for Tender Quotation.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Request for Tender Quotation.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: BtsoqoHwldFQNw.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, daT0KqK7FojnsTUp9J.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: _0020.SetAccessControl
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: _0020.AddAccessRule
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: _0020.SetAccessControl
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, IfGbZh27ZJymHMFGHY.cs Security API names: _0020.AddAccessRule
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, daT0KqK7FojnsTUp9J.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.evad.winEXE@21/15@0/1
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4112:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Mutant created: \Sessions\1\BaseNamedObjects\xBissayiDEPUFvqGNBhP
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7228:120:WilError_03
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File created: C:\Users\user\AppData\Local\Temp\tmp8B7B.tmp Jump to behavior
Source: Request for Tender Quotation.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Request for Tender Quotation.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Request for Tender Quotation.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File read: C:\Users\user\Desktop\Request for Tender Quotation.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe"
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request for Tender Quotation.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmp8B7B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe"
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmpA29D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe"
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmp8B7B.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmpA29D.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Request for Tender Quotation.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Request for Tender Quotation.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.00000000018CB000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001594000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.ServiceModel.pdb0 source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.ServiceModel.pdbpdbdel.pdb source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001901000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001586000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.ServiceModel.pdbY source: BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.0000000001594000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceModel.pdb source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.0000000001866000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.Request for Tender Quotation.exe.75f0000.4.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, IfGbZh27ZJymHMFGHY.cs .Net Code: Urs7rFEYg5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, IfGbZh27ZJymHMFGHY.cs .Net Code: Urs7rFEYg5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.Request for Tender Quotation.exe.3308ad4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 11.2.BtsoqoHwldFQNw.exe.3038ab0.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Code function: 0_2_0777A173 push eax; retf 0_2_0777A175
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054D27E2 pushfd ; iretd 11_2_054D27F9
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054D33C5 pushfd ; iretd 11_2_054D33CD
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_054DF8F0 pushfd ; ret 11_2_054DF8F9
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_0763A672 pushad ; retf 11_2_0763A679
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_0763A6B0 pushad ; retf 11_2_0763A679
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 11_2_0763AB22 pushad ; iretd 11_2_0763AB29
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Code function: 15_2_057CD442 push eax; ret 15_2_057CD451
Source: Request for Tender Quotation.exe Static PE information: section name: .text entropy: 7.82807161657414
Source: BtsoqoHwldFQNw.exe.0.dr Static PE information: section name: .text entropy: 7.82807161657414
Source: 0.2.Request for Tender Quotation.exe.75f0000.4.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Request for Tender Quotation.exe.75f0000.4.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, tE10bASu1JFjvvmW07.cs High entropy of concatenated method names: 'TAEeohkiwT', 's9HebPenZP', 'uR3erA8Zis', 'ivGeww5HFL', 'Yj2ecv7suk', 'dQeeUOh36l', 'GqQeOGEZGW', 'tSVeK8fb9f', 'Ow8evO324l', 'mIceJpOlwN'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, reNnnsaAMMvKYOoAIC.cs High entropy of concatenated method names: 'udrEybuILZ', 'R9aEYj2O6L', 'AZBEuJxVgL', 'TciEefgkZb', 'zhAE2OTOPI', 'crbuHuXhfj', 'uFru1vnWCK', 'wuCuAvv2LP', 'HqduiDaWyG', 'QcMuxGdpn2'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, Lf9yOQvx6XQCc7oSXN.cs High entropy of concatenated method names: 'QZdXwTd45C', 'GMIXUn25Nj', 'vHyXKhqGGm', 'k8TXvjCyHA', 'AdnXtlRaWd', 'tH2Xl46lZn', 'fEZXgDYBRk', 'NsxXGGtt88', 'saUXD8EdOM', 'mYlXRKcwN1'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, kgyWVXijm5N6NQYjHj.cs High entropy of concatenated method names: 'hFOGB4d3DV', 'QjsGYsMOLL', 'GpnGXb4UYX', 'TE2GuEesXM', 'nLRGEqCNDP', 'NcmGeafMXb', 'FXUG2dfCn7', 'ahcGCMBBDB', 'deOGTPSb19', 'ND5GsSnqWV'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, TMCtjF01gufRCarAV7.cs High entropy of concatenated method names: 'sAGtZC1WoE', 'MeqtqOSYvu', 'JPBt0knCwq', 'TMCt6nRWQR', 'LhothNvSWH', 'VWutLQ7l3n', 'C8ItMOEHJQ', 'Me4tkVfe45', 'AfVtPu0Y6G', 'h9ctnJafa1'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, AXcclwYQkkov6ttZMK.cs High entropy of concatenated method names: 'Dispose', 'AHvQxG3Zcc', 'N0NFh4WLfx', 'QoFAAv9ELt', 'y2gQ9yWVXj', 'O5NQz6NQYj', 'ProcessDialogKey', 'UjVFVvHVqo', 'W3PFQB5JZp', 'oKBFFRYvSM'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, avHVqoxi3PB5JZpjKB.cs High entropy of concatenated method names: 'KghGaZTqOX', 'k0LGhlwVMW', 'Yj3GLcXnJA', 'W6mGMJcJhc', 'iesG0Fcu59', 'kscGkOl8XZ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, XdFeYY8gBs1yRrivQO.cs High entropy of concatenated method names: 'ErjjKULt5g', 'BI8jvhqydC', 'ThQjaFnKtl', 'h0GjhDyxS2', 'grvjM5KcQd', 'uVDjkftUP7', 'X6ajnOgypn', 'U3gj3t5elQ', 'GYejZxDG4B', 'kCYjmKEZ7i'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, PFTbecQVRiVyeM7dFOA.cs High entropy of concatenated method names: 'uv5Do4J4pE', 'jrhDbpUUAO', 'uUsDrj9xHc', 'ONiDwuffX1', 'uTQDcOwaPM', 'mUSDUqciP0', 'S6nDOG3jt9', 'LnADKCgSvy', 'jqaDv9f36b', 'jYuDJlIZt7'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, Ba3k1qJLNGTNSgT7fr.cs High entropy of concatenated method names: 'RFbuchGLVV', 'USOuOlxQND', 'a5RXLu6ts4', 'A6qXMRcRDp', 'AxHXke8Gqn', 'P5uXPecCda', 'mKUXndjiPf', 'Q2vX3aP96m', 'yjsXSxapUK', 'xNlXZDhBWx'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, TACZNfPi4y4hMeDm41.cs High entropy of concatenated method names: 'Q0CEIRqt8d', 'PWiEN5DoyY', 'AXtEH3mBWi', 'ToString', 'J0UE1fvRKE', 'wZjEABX1P5', 'QPXsJPSBcy4N2Qa1Ghb', 'SeeFyCSj32QvYWnFmt5', 'vo44KOSIdPlpr3tKdVy'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, nJTN3LhDNWlQs3fa4i.cs High entropy of concatenated method names: 'kYWmVoSMhB0kgw10iso', 'KjXswkSHYKY07OdjEAQ', 'MN5EGnWPGL', 'iBnEDDM7nu', 'gnOERAEs6y', 'ywu1ZySKUxulkBAikCM', 'xoQNsbS79R2kscSTVOu', 'tyhUjASPXp3ddFExtqI'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, hFRLn4M4SXuLJoCxSr.cs High entropy of concatenated method names: 'qFOEWhcL6y', 'KqOEotQ8KL', 'MHmErxm0QN', 'IugEwajFPs', 'aauEUEJ9Cy', 'ytKEOMIq7y', 'FGLEvLhkbc', 'bNyEJUMfYF', 'gVPNkASkURecUg5cEcL', 'qoV1nWS8BV0cXZOu9Xu'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, tsDgAnFortVxnjhMDD.cs High entropy of concatenated method names: 'poYr0HZ7S', 'biNwMnZxX', 'hqSUgcXwq', 'fJiO9rTtH', 'GgWvA1Aj1', 'NuDJRYa2e', 'jrEXCTb64Q7WD8IYvl', 'k2YwwxJQ86c74kR0Og', 'KkkGjeChb', 'yaMRZC8CM'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, Bpr3QgNjOyLYLPaXT8.cs High entropy of concatenated method names: 'JgogTTdHoB', 'oRVgsBAQJ3', 'ToString', 'MGvgBCn5WW', 'kkpgYyKbmF', 'W0VgXInwuB', 'QprguZOuY7', 'vIhgEesqpb', 'NktgePrDtL', 'WMwg2hAnQ3'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, sTsuRx7RqOKJmfu5Z4.cs High entropy of concatenated method names: 'lC7QeaT0Kq', 'dFoQ2jnsTU', 'bx6QTXQCc7', 'xSXQsNUa3k', 'pT7QtfrGeN', 'LnsQlAMMvK', 'uiUC392C7muJtDAlNf', 's9eCCSvwGgkEIDOZF4', 'OKrQQQJMeA', 'BUWQdJMXYt'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, kJy4dRnCIXPcsdwIV2.cs High entropy of concatenated method names: 'FADeBD2W4q', 't0YeX6GOhQ', 'aaSeERKxAH', 'zmLE9KyMFJ', 'rNoEzNRiM1', 'QBmeVf3t21', 'vHieQRYbdN', 'KTaeFFOHpl', 'oY2edc5FMI', 'DZWe7uOHD3'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, iSIHUl1pH54JhDfeqs.cs High entropy of concatenated method names: 'S7cgiSv1vI', 'XqNg9nxX89', 'lM7GVhyKmT', 'gGrGQwnl7Y', 'l7Ggm3lVOs', 'qT3gqxlx6B', 'idyg8dXft4', 'G1qg0SrtyX', 'rJ8g6GjmeC', 'hyTgIkdHAR'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, UOWwNrQdesGSW7miGjH.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CltR0IUIRy', 'oBiR61V1hA', 'kxPRIHDUgH', 'ggjRN9LEqk', 'lXoRHZbfk4', 'kDcR1t9n80', 'jmkRA8ynDF'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, daT0KqK7FojnsTUp9J.cs High entropy of concatenated method names: 'P6JY0VlhxM', 'x0iY6KL3b8', 'EbkYIGQ9BC', 'oSqYNGZ9bS', 'kFxYHvQAin', 'taVY1Qk2Cu', 'SN2YAg0E9K', 'BruYi4cdKo', 'JCeYxtUiqw', 'VOLY9DsCsy'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, IfGbZh27ZJymHMFGHY.cs High entropy of concatenated method names: 'NZidyMd1GY', 'UVFdBHAyDM', 'NNpdYqF4s9', 'tTrdXW8JIF', 'BnlduQl9qp', 'lusdEOwnaW', 'HOUde2wyju', 'JOTd2s07pk', 'laTdCBiBV3', 'WW7dTMbQM3'
Source: 0.2.Request for Tender Quotation.exe.8710000.5.raw.unpack, sYvSMm9fkS5lVWuTnW.cs High entropy of concatenated method names: 'qbpDQq1CBY', 'ShuDdgrP7U', 'bh8D7nx9Bq', 'mbrDBKuvnH', 'IuMDYLl8gC', 'KunDun5bDy', 'scNDE2PJUF', 'bdyGAJACKW', 'lLoGisC8h2', 'DIpGxKwAeC'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, tE10bASu1JFjvvmW07.cs High entropy of concatenated method names: 'TAEeohkiwT', 's9HebPenZP', 'uR3erA8Zis', 'ivGeww5HFL', 'Yj2ecv7suk', 'dQeeUOh36l', 'GqQeOGEZGW', 'tSVeK8fb9f', 'Ow8evO324l', 'mIceJpOlwN'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, reNnnsaAMMvKYOoAIC.cs High entropy of concatenated method names: 'udrEybuILZ', 'R9aEYj2O6L', 'AZBEuJxVgL', 'TciEefgkZb', 'zhAE2OTOPI', 'crbuHuXhfj', 'uFru1vnWCK', 'wuCuAvv2LP', 'HqduiDaWyG', 'QcMuxGdpn2'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, Lf9yOQvx6XQCc7oSXN.cs High entropy of concatenated method names: 'QZdXwTd45C', 'GMIXUn25Nj', 'vHyXKhqGGm', 'k8TXvjCyHA', 'AdnXtlRaWd', 'tH2Xl46lZn', 'fEZXgDYBRk', 'NsxXGGtt88', 'saUXD8EdOM', 'mYlXRKcwN1'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, kgyWVXijm5N6NQYjHj.cs High entropy of concatenated method names: 'hFOGB4d3DV', 'QjsGYsMOLL', 'GpnGXb4UYX', 'TE2GuEesXM', 'nLRGEqCNDP', 'NcmGeafMXb', 'FXUG2dfCn7', 'ahcGCMBBDB', 'deOGTPSb19', 'ND5GsSnqWV'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, TMCtjF01gufRCarAV7.cs High entropy of concatenated method names: 'sAGtZC1WoE', 'MeqtqOSYvu', 'JPBt0knCwq', 'TMCt6nRWQR', 'LhothNvSWH', 'VWutLQ7l3n', 'C8ItMOEHJQ', 'Me4tkVfe45', 'AfVtPu0Y6G', 'h9ctnJafa1'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, AXcclwYQkkov6ttZMK.cs High entropy of concatenated method names: 'Dispose', 'AHvQxG3Zcc', 'N0NFh4WLfx', 'QoFAAv9ELt', 'y2gQ9yWVXj', 'O5NQz6NQYj', 'ProcessDialogKey', 'UjVFVvHVqo', 'W3PFQB5JZp', 'oKBFFRYvSM'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, avHVqoxi3PB5JZpjKB.cs High entropy of concatenated method names: 'KghGaZTqOX', 'k0LGhlwVMW', 'Yj3GLcXnJA', 'W6mGMJcJhc', 'iesG0Fcu59', 'kscGkOl8XZ', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, XdFeYY8gBs1yRrivQO.cs High entropy of concatenated method names: 'ErjjKULt5g', 'BI8jvhqydC', 'ThQjaFnKtl', 'h0GjhDyxS2', 'grvjM5KcQd', 'uVDjkftUP7', 'X6ajnOgypn', 'U3gj3t5elQ', 'GYejZxDG4B', 'kCYjmKEZ7i'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, PFTbecQVRiVyeM7dFOA.cs High entropy of concatenated method names: 'uv5Do4J4pE', 'jrhDbpUUAO', 'uUsDrj9xHc', 'ONiDwuffX1', 'uTQDcOwaPM', 'mUSDUqciP0', 'S6nDOG3jt9', 'LnADKCgSvy', 'jqaDv9f36b', 'jYuDJlIZt7'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, Ba3k1qJLNGTNSgT7fr.cs High entropy of concatenated method names: 'RFbuchGLVV', 'USOuOlxQND', 'a5RXLu6ts4', 'A6qXMRcRDp', 'AxHXke8Gqn', 'P5uXPecCda', 'mKUXndjiPf', 'Q2vX3aP96m', 'yjsXSxapUK', 'xNlXZDhBWx'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, TACZNfPi4y4hMeDm41.cs High entropy of concatenated method names: 'Q0CEIRqt8d', 'PWiEN5DoyY', 'AXtEH3mBWi', 'ToString', 'J0UE1fvRKE', 'wZjEABX1P5', 'QPXsJPSBcy4N2Qa1Ghb', 'SeeFyCSj32QvYWnFmt5', 'vo44KOSIdPlpr3tKdVy'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, nJTN3LhDNWlQs3fa4i.cs High entropy of concatenated method names: 'kYWmVoSMhB0kgw10iso', 'KjXswkSHYKY07OdjEAQ', 'MN5EGnWPGL', 'iBnEDDM7nu', 'gnOERAEs6y', 'ywu1ZySKUxulkBAikCM', 'xoQNsbS79R2kscSTVOu', 'tyhUjASPXp3ddFExtqI'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, hFRLn4M4SXuLJoCxSr.cs High entropy of concatenated method names: 'qFOEWhcL6y', 'KqOEotQ8KL', 'MHmErxm0QN', 'IugEwajFPs', 'aauEUEJ9Cy', 'ytKEOMIq7y', 'FGLEvLhkbc', 'bNyEJUMfYF', 'gVPNkASkURecUg5cEcL', 'qoV1nWS8BV0cXZOu9Xu'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, tsDgAnFortVxnjhMDD.cs High entropy of concatenated method names: 'poYr0HZ7S', 'biNwMnZxX', 'hqSUgcXwq', 'fJiO9rTtH', 'GgWvA1Aj1', 'NuDJRYa2e', 'jrEXCTb64Q7WD8IYvl', 'k2YwwxJQ86c74kR0Og', 'KkkGjeChb', 'yaMRZC8CM'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, Bpr3QgNjOyLYLPaXT8.cs High entropy of concatenated method names: 'JgogTTdHoB', 'oRVgsBAQJ3', 'ToString', 'MGvgBCn5WW', 'kkpgYyKbmF', 'W0VgXInwuB', 'QprguZOuY7', 'vIhgEesqpb', 'NktgePrDtL', 'WMwg2hAnQ3'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, sTsuRx7RqOKJmfu5Z4.cs High entropy of concatenated method names: 'lC7QeaT0Kq', 'dFoQ2jnsTU', 'bx6QTXQCc7', 'xSXQsNUa3k', 'pT7QtfrGeN', 'LnsQlAMMvK', 'uiUC392C7muJtDAlNf', 's9eCCSvwGgkEIDOZF4', 'OKrQQQJMeA', 'BUWQdJMXYt'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, kJy4dRnCIXPcsdwIV2.cs High entropy of concatenated method names: 'FADeBD2W4q', 't0YeX6GOhQ', 'aaSeERKxAH', 'zmLE9KyMFJ', 'rNoEzNRiM1', 'QBmeVf3t21', 'vHieQRYbdN', 'KTaeFFOHpl', 'oY2edc5FMI', 'DZWe7uOHD3'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, iSIHUl1pH54JhDfeqs.cs High entropy of concatenated method names: 'S7cgiSv1vI', 'XqNg9nxX89', 'lM7GVhyKmT', 'gGrGQwnl7Y', 'l7Ggm3lVOs', 'qT3gqxlx6B', 'idyg8dXft4', 'G1qg0SrtyX', 'rJ8g6GjmeC', 'hyTgIkdHAR'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, UOWwNrQdesGSW7miGjH.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CltR0IUIRy', 'oBiR61V1hA', 'kxPRIHDUgH', 'ggjRN9LEqk', 'lXoRHZbfk4', 'kDcR1t9n80', 'jmkRA8ynDF'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, daT0KqK7FojnsTUp9J.cs High entropy of concatenated method names: 'P6JY0VlhxM', 'x0iY6KL3b8', 'EbkYIGQ9BC', 'oSqYNGZ9bS', 'kFxYHvQAin', 'taVY1Qk2Cu', 'SN2YAg0E9K', 'BruYi4cdKo', 'JCeYxtUiqw', 'VOLY9DsCsy'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, IfGbZh27ZJymHMFGHY.cs High entropy of concatenated method names: 'NZidyMd1GY', 'UVFdBHAyDM', 'NNpdYqF4s9', 'tTrdXW8JIF', 'BnlduQl9qp', 'lusdEOwnaW', 'HOUde2wyju', 'JOTd2s07pk', 'laTdCBiBV3', 'WW7dTMbQM3'
Source: 0.2.Request for Tender Quotation.exe.45aab90.2.raw.unpack, sYvSMm9fkS5lVWuTnW.cs High entropy of concatenated method names: 'qbpDQq1CBY', 'ShuDdgrP7U', 'bh8D7nx9Bq', 'mbrDBKuvnH', 'IuMDYLl8gC', 'KunDun5bDy', 'scNDE2PJUF', 'bdyGAJACKW', 'lLoGisC8h2', 'DIpGxKwAeC'
Source: 0.2.Request for Tender Quotation.exe.3308ad4.0.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Request for Tender Quotation.exe.3308ad4.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 11.2.BtsoqoHwldFQNw.exe.3038ab0.0.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 11.2.BtsoqoHwldFQNw.exe.3038ab0.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Drops PE files
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe File created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmp8B7B.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Request for Tender Quotation.exe PID: 4512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: BtsoqoHwldFQNw.exe PID: 7448, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 13F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 32D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 3010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 88E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 98E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 9AB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: AAB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 16F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 34F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: 1750000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 1440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 3000000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 2F00000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 7D30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 8D30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 8EE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 9EE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 1870000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 3290000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory allocated: 31A0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8071 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1450 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7543 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1981 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe TID: 5852 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7360 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7396 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe TID: 7376 Thread sleep time: -75000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe TID: 7472 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe TID: 7760 Thread sleep time: -75000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Request for Tender Quotation.exe, 00000000.00000002.2212400913.000000000457E000.00000004.00000800.00020000.00000000.sdmp, Request for Tender Quotation.exe, 00000000.00000002.2218178464.0000000008710000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: VRVRsHGFsR
Source: Request for Tender Quotation.exe, 0000000A.00000002.3424586120.00000000018CB000.00000004.00000020.00020000.00000000.sdmp, BtsoqoHwldFQNw.exe, 0000000F.00000002.3422939745.00000000014E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request for Tender Quotation.exe"
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe"
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Memory written: C:\Users\user\Desktop\Request for Tender Quotation.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Memory written: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmp8B7B.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Process created: C:\Users\user\Desktop\Request for Tender Quotation.exe "C:\Users\user\Desktop\Request for Tender Quotation.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtsoqoHwldFQNw" /XML "C:\Users\user\AppData\Local\Temp\tmpA29D.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Process created: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe "C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Users\user\Desktop\Request for Tender Quotation.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Users\user\Desktop\Request for Tender Quotation.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\BtsoqoHwldFQNw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Desktop\Request for Tender Quotation.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.436e640.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.436e640.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.43b9860.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.43b9860.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.3422027027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000043A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3422027027.0000000000425000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Tender Quotation.exe PID: 4512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Request for Tender Quotation.exe PID: 7372, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.436e640.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.436e640.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.43b9860.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Request for Tender Quotation.exe.43b9860.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.3422027027.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000043A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.3422027027.0000000000425000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000042D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2212400913.00000000043ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Request for Tender Quotation.exe PID: 4512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: Request for Tender Quotation.exe PID: 7372, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1516760 Sample: Request for Tender Quotation.exe Startdate: 24/09/2024 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 12 other signatures 2->53 7 Request for Tender Quotation.exe 7 2->7         started        11 BtsoqoHwldFQNw.exe 5 2->11         started        process3 file4 37 C:\Users\user\AppData\...\BtsoqoHwldFQNw.exe, PE32 7->37 dropped 39 C:\...\BtsoqoHwldFQNw.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp8B7B.tmp, XML 7->41 dropped 43 C:\...\Request for Tender Quotation.exe.log, ASCII 7->43 dropped 55 Adds a directory exclusion to Windows Defender 7->55 57 Injects a PE file into a foreign processes 7->57 13 powershell.exe 23 7->13         started        16 powershell.exe 23 7->16         started        18 Request for Tender Quotation.exe 2 7->18         started        25 2 other processes 7->25 59 Antivirus detection for dropped file 11->59 61 Multi AV Scanner detection for dropped file 11->61 63 Machine Learning detection for dropped file 11->63 21 schtasks.exe 11->21         started        23 BtsoqoHwldFQNw.exe 11->23         started        signatures5 process6 dnsIp7 65 Loading BitLocker PowerShell Module 13->65 27 conhost.exe 13->27         started        29 WmiPrvSE.exe 13->29         started        31 conhost.exe 16->31         started        45 198.12.90.244, 49732, 49733, 49735 AS-COLOCROSSINGUS United States 18->45 33 conhost.exe 21->33         started        35 conhost.exe 25->35         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.12.90.244
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
198.12.90.244:49780 true
  • Avira URL Cloud: safe
 unknown