Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report TR-D45.pdf.exe

Overview

General Information

Sample Name:TR-D45.pdf.exe
Analysis ID:321007
MD5:937841064411662c36469498ea645660
SHA1:7e72225620b06b6d9f5d54ee45ca2dd7ba10e87e
SHA256:3b162f2943b2ee8d6075b2f8f4cbd7832e11b50ecdfcb4a68cf18eb1c7614651
Tags:exeGuLoader

Most interesting Screenshot:

Detection

FormBook GuLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Yara detected Generic Dropper
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected VB6 Downloader Generic
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • TR-D45.pdf.exe (PID: 6060 cmdline: 'C:\Users\user\Desktop\TR-D45.pdf.exe' MD5: 937841064411662C36469498EA645660)
    • TR-D45.pdf.exe (PID: 3668 cmdline: 'C:\Users\user\Desktop\TR-D45.pdf.exe' MD5: 937841064411662C36469498EA645660)
      • explorer.exe (PID: 3472 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • control.exe (PID: 6660 cmdline: C:\Windows\SysWOW64\control.exe MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)
          • cmd.exe (PID: 6676 cmdline: /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x1b307:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1c30a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x183e9:$sqlite3step: 68 34 1C 7B E1
    • 0x184fc:$sqlite3step: 68 34 1C 7B E1
    • 0x18418:$sqlite3text: 68 38 2A 90 C5
    • 0x1853d:$sqlite3text: 68 38 2A 90 C5
    • 0x1842b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x18553:$sqlite3blob: 68 53 D8 7F 8C
    0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmpLokiBot_Dropper_Packed_R11_Feb18Auto-generated rule - file scan copy.pdf.r11Florian Roth
    • 0x47b4:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
    0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 18 entries

      Sigma Overview

      System Summary:

      barindex
      Sigma detected: Suspicious Double ExtensionShow sources
      Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: 'C:\Users\user\Desktop\TR-D45.pdf.exe' , CommandLine: 'C:\Users\user\Desktop\TR-D45.pdf.exe' , CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\TR-D45.pdf.exe, NewProcessName: C:\Users\user\Desktop\TR-D45.pdf.exe, OriginalFileName: C:\Users\user\Desktop\TR-D45.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\TR-D45.pdf.exe' , ParentImage: C:\Users\user\Desktop\TR-D45.pdf.exe, ParentProcessId: 6060, ProcessCommandLine: 'C:\Users\user\Desktop\TR-D45.pdf.exe' , ProcessId: 3668

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: TR-D45.pdf.exeVirustotal: Detection: 29%Perma Link
      Source: TR-D45.pdf.exeReversingLabs: Detection: 14%
      Yara detected FormBookShow sources
      Source: Yara matchFile source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 4x nop then pop ebx
      Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop ebx
      Source: C:\Windows\SysWOW64\control.exeCode function: 4x nop then pop edi

      Networking:

      barindex
      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
      Source: TrafficSnort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.5:49743
      Source: global trafficHTTP traffic detected: GET /gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi HTTP/1.1Host: www.gcvinternational.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
      Source: global trafficHTTP traffic detected: GET /gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd HTTP/1.1Host: www.celebrations.sucksConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
      Source: Joe Sandbox ViewIP Address: 34.102.136.180 34.102.136.180
      Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
      Source: Joe Sandbox ViewASN Name: GOOGLEUS GOOGLEUS
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: global trafficHTTP traffic detected: GET /gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi HTTP/1.1Host: www.gcvinternational.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
      Source: global trafficHTTP traffic detected: GET /gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd HTTP/1.1Host: www.celebrations.sucksConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
      Source: unknownDNS traffic detected: queries for: pilatescollective.com
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.G
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://cert.int-x3.letsencrypt.org/0
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://cps.letsencrypt.org0
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.int-x3.letsencrypt.org0/
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
      Source: control.exe, 0000000C.00000002.497562201.0000000004E2F000.00000004.00000001.sdmpString found in binary or memory: http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
      Source: explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
      Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpString found in binary or memory: https://pilatescollective.com/
      Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpString found in binary or memory: https://pilatescollective.com/D4
      Source: TR-D45.pdf.exeString found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin
      Source: TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmpString found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin/
      Source: TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmpString found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin7
      Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpString found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin=WyM
      Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpString found in binary or memory: https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.binl
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443

      E-Banking Fraud:

      barindex
      Yara detected FormBookShow sources
      Source: Yara matchFile source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY

      System Summary:

      barindex
      Malicious sample detected (through community Yara rule)Show sources
      Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
      Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
      Source: 0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
      Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
      Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
      Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
      Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
      Source: 0000000C.00000002.497491783.000000000493F000.00000004.00000001.sdmp, type: MEMORYMatched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
      Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
      Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
      Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
      Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: TR-D45.pdf.exe
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399264 NtProtectVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239071B EnumWindows,NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239877D NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399799 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390A92 NtSetInformationThread,TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023989D5 NtSetInformationThread,LoadLibraryA,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393721 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239371B NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393787 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023907E7 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023937DC NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023917D1 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023937D3 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023997D7 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02398486 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023915D6 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393A2B NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399A23 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393A7F NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399A57 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02391AAA NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399A87 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393AE3 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399B17 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399B53 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393B43 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02397BBE NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393B97 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399B8F NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393BDE NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399BD7 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399837 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393823 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399807 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239387B NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239087B NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239989F NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023998F7 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023998CB NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023908C7 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399933 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239092B NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239397F NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023999BB NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393985 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023999F7 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023919D3 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023939D7 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399E07 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02391E85 NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392F0A NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02397FCC NtSetInformationThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399C1F NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399C57 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393C43 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399CB7 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393CC3 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393D1F NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399D1F NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399D5F NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393D8B NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399DD3 NtResumeThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02393DCB NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9660 NtAllocateVirtualMemory,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A96E0 NtFreeVirtualMemory,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9710 NtQueryInformationToken,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A97A0 NtUnmapViewOfSection,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9780 NtMapViewOfSection,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9540 NtReadFile,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A95D0 NtClose,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9A20 NtResumeThread,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9A00 NtProtectVirtualMemory,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9A50 NtCreateFile,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9860 NtQuerySystemInformation,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9840 NtDelayExecution,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A98F0 NtReadVirtualMemory,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A99A0 NtCreateSection,LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9610 NtEnumerateValueKey,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9670 NtQueryInformationProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9650 NtQueryValueKey,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A96D0 NtCreateKey,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9730 NtQueryVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2AA710 NtOpenProcessToken,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9760 NtOpenProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2AA770 NtOpenThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9770 NtSetInformationFile,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9FE0 NtCreateMutant,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9520 NtWaitForSingleObject,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2AAD30 NtSetContextThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9560 NtWriteFile,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A95F0 NtQueryInformationFile,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9A10 NtQuerySection,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9A80 NtOpenDirectoryObject,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9B00 NtSetValueKey,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2AA3B0 NtGetContextThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9820 NtEnumerateKey,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2AB040 NtSuspendThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A98A0 NtWriteVirtualMemory,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A9950 NtQueueApcThread,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A99D0 NtCreateProcessEx,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479840 NtDelayExecution,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479860 NtQuerySystemInformation,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479540 NtReadFile,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479910 NtAdjustPrivilegesToken,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044795D0 NtClose,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044799A0 NtCreateSection,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479A50 NtCreateFile,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479650 NtQueryValueKey,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479660 NtAllocateVirtualMemory,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044796D0 NtCreateKey,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044796E0 NtFreeVirtualMemory,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479710 NtQueryInformationToken,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479FE0 NtCreateMutant,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479780 NtMapViewOfSection,LdrInitializeThunk,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447B040 NtSuspendThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479820 NtEnumerateKey,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044798F0 NtReadVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044798A0 NtWriteVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479950 NtQueueApcThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479560 NtWriteFile,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479520 NtWaitForSingleObject,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447AD30 NtSetContextThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044799D0 NtCreateProcessEx,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044795F0 NtQueryInformationFile,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479670 NtQueryInformationProcess,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479A00 NtProtectVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479610 NtEnumerateValueKey,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479A10 NtQuerySection,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479A20 NtResumeThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479A80 NtOpenDirectoryObject,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479760 NtOpenProcess,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479770 NtSetInformationFile,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447A770 NtOpenThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479B00 NtSetValueKey,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447A710 NtOpenProcessToken,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04479730 NtQueryVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044797A0 NtUnmapViewOfSection,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447A3B0 NtGetContextThread,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459E70 NtClose,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459F20 NtAllocateVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459D40 NtCreateFile,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459DF0 NtReadFile,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459E6A NtReadFile,NtClose,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459E9B NtClose,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459F1A NtAllocateVirtualMemory,
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02459D92 NtCreateFile,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_00404E8F
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0040568E
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E286E30
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32D616
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E332EF7
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E331FF1
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33DFCE
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27841F
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32D466
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E260D20
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E332D07
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E331D55
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292581
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27D5E0
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3325DD
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3322AE
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E332B28
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29EBB0
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32DBD2
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3203DA
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33E824
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321002
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3320A8
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27B090
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3328EC
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26F900
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_000BD340
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FD466
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1002
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444841F
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045028EC
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444B090
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045020A8
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04501D55
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443F900
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04502D07
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04430D20
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045025DD
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444D5E0
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462581
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04456E30
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04502EF7
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045022AE
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04502B28
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FDBD2
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04501FF1
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446EBB0
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245D340
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02449E40
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02449E3C
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245CF86
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245DF94
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02442FB0
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02442D87
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02442D90
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: String function: 1E26B150 appears 45 times
      Source: C:\Windows\SysWOW64\control.exeCode function: String function: 0443B150 appears 35 times
      Source: TR-D45.pdf.exe, 00000000.00000002.247663244.0000000002250000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000000.00000000.228367580.0000000000414000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exeBinary or memory string: OriginalFilename vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000001.00000002.320194787.000000001E4EF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000001.00000003.313426694.0000000000919000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameCONTROL.EXEj% vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000001.00000000.246411137.0000000000414000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000001.00000002.319716219.000000001DDB0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exe, 00000001.00000002.319651921.000000001DC60000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs TR-D45.pdf.exe
      Source: TR-D45.pdf.exeBinary or memory string: OriginalFilenameSBEKASSEBILER.exe vs TR-D45.pdf.exe
      Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
      Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
      Source: 0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
      Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
      Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
      Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
      Source: 0000000C.00000002.497491783.000000000493F000.00000004.00000001.sdmp, type: MEMORYMatched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
      Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
      Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
      Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
      Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/0@8/3
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_01
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile created: C:\Users\user\AppData\Local\Temp\~DF02231C1D730B1CDB.TMPJump to behavior
      Source: TR-D45.pdf.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dll
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: TR-D45.pdf.exeVirustotal: Detection: 29%
      Source: TR-D45.pdf.exeReversingLabs: Detection: 14%
      Source: unknownProcess created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: unknownProcess created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: unknownProcess created: C:\Windows\SysWOW64\control.exe C:\Windows\SysWOW64\control.exe
      Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.292398447.00000000070D0000.00000002.00000001.sdmp
      Source: Binary string: control.pdb source: TR-D45.pdf.exe
      Source: Binary string: wntdll.pdbUGP source: TR-D45.pdf.exe, 00000001.00000002.319908654.000000001E240000.00000040.00000001.sdmp, control.exe, 0000000C.00000003.314263718.00000000040E0000.00000004.00000001.sdmp
      Source: Binary string: wntdll.pdb source: TR-D45.pdf.exe, control.exe
      Source: Binary string: control.pdbUGP source: TR-D45.pdf.exe, 00000001.00000002.314034549.00000000000D0000.00000040.00000001.sdmp
      Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.292398447.00000000070D0000.00000002.00000001.sdmp

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: TR-D45.pdf.exe PID: 6060, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: TR-D45.pdf.exe PID: 6060, type: MEMORY
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_004114BC push eax; ret
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02395BD8 push ss; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239497F push ss; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02394954 push ss; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023949AB push ss; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023949DF push ss; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_3_0091C611 push ecx; ret
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_3_00930BDE push ebx; iretd
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2BD0D1 push ecx; ret
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_000B7811 push cs; retf
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_000BDA6C push edi; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0448D0D1 push ecx; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245DA6C push edi; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_024563C0 pushad ; retf
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02457811 push cs; retf
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245CEE2 push eax; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245CEEB push eax; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245CE95 push eax; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245CF4C push eax; ret
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_02456437 pushad ; retf
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0245E4B2 push cs; retf

      Hooking and other Techniques for Hiding and Protection:

      barindex
      Modifies the prolog of user mode functions (user mode inline hooks)Show sources
      Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xEB
      Uses an obfuscated file name to hide its real file extension (double extension)Show sources
      Source: Possible double extension: pdf.exeStatic PE information: TR-D45.pdf.exe
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\SysWOW64\control.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390A92 NtSetInformationThread,TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390BAE TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390AC7 TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390B37 TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390B9C TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390B83 TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390BD3 TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390C27 TerminateProcess,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02390C67 TerminateProcess,
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 00000000023980C6 second address: 00000000023980C6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a call 00007FF010BA7BE8h 0x0000000f lfence 0x00000012 mov edx, dword ptr [7FFE0014h] 0x00000018 lfence 0x0000001b ret 0x0000001c sub edx, esi 0x0000001e ret 0x0000001f fnop 0x00000021 add edi, edx 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 jmp 00007FF010BA7C0Eh 0x0000002b cmp ecx, BDD4905Dh 0x00000031 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000038 jne 00007FF010BA7B93h 0x0000003a cmp bx, bx 0x0000003d call 00007FF010BA7C42h 0x00000042 call 00007FF010BA7BFAh 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc
      Tries to detect Any.runShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile opened: C:\Program Files\qga\qga.exe
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeFile opened: C:\Program Files\qga\qga.exe
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: TR-D45.pdf.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 00000000023980C6 second address: 00000000023980C6 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a call 00007FF010BA7BE8h 0x0000000f lfence 0x00000012 mov edx, dword ptr [7FFE0014h] 0x00000018 lfence 0x0000001b ret 0x0000001c sub edx, esi 0x0000001e ret 0x0000001f fnop 0x00000021 add edi, edx 0x00000023 dec dword ptr [ebp+000000F8h] 0x00000029 jmp 00007FF010BA7C0Eh 0x0000002b cmp ecx, BDD4905Dh 0x00000031 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000038 jne 00007FF010BA7B93h 0x0000003a cmp bx, bx 0x0000003d call 00007FF010BA7C42h 0x00000042 call 00007FF010BA7BFAh 0x00000047 lfence 0x0000004a mov edx, dword ptr [7FFE0014h] 0x00000050 lfence 0x00000053 ret 0x00000054 mov esi, edx 0x00000056 pushad 0x00000057 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 00000000023980E8 second address: 00000000023980E8 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 bt ecx, 1Fh 0x00000019 jc 00007FF010BA1252h 0x0000001f popad 0x00000020 call 00007FF010BA0BCFh 0x00000025 lfence 0x00000028 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 0000000002390F1B second address: 0000000002399812 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push dword ptr [ebp+0000009Ch] 0x00000009 cmp bh, bh 0x0000000b push eax 0x0000000c jmp 00007FF010BA7C0Eh 0x0000000e cmp dh, ah 0x00000010 call 00007FF010BB03E8h 0x00000015 jmp 00007FF010BA7C12h 0x00000017 cmp ax, cx 0x0000001a call 00007FF010BA7BE5h 0x0000001f pop ebx 0x00000020 sub ebx, 05h 0x00000023 inc ebx 0x00000024 dec ebx 0x00000025 xor edx, edx 0x00000027 mov eax, ebx 0x00000029 mov ecx, 00000004h 0x0000002e div ecx 0x00000030 jmp 00007FF010BA7C0Eh 0x00000032 cmp dh, ah 0x00000034 cmp edx, 00000000h 0x00000037 jne 00007FF010BA7BA1h 0x00000039 movd mm3, ebx 0x0000003c jmp 00007FF010BA7C0Ah 0x0000003e pushad 0x0000003f mov edx, 00000023h 0x00000044 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 00000000005680E8 second address: 00000000005680E8 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e mov eax, 00000001h 0x00000013 cpuid 0x00000015 bt ecx, 1Fh 0x00000019 jc 00007FF010BA1252h 0x0000001f popad 0x00000020 call 00007FF010BA0BCFh 0x00000025 lfence 0x00000028 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 0000000000560F1B second address: 0000000000569812 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 push dword ptr [ebp+0000009Ch] 0x00000009 cmp bh, bh 0x0000000b push eax 0x0000000c jmp 00007FF010BA7C0Eh 0x0000000e cmp dh, ah 0x00000010 call 00007FF010BB03E8h 0x00000015 jmp 00007FF010BA7C12h 0x00000017 cmp ax, cx 0x0000001a call 00007FF010BA7BE5h 0x0000001f pop ebx 0x00000020 sub ebx, 05h 0x00000023 inc ebx 0x00000024 dec ebx 0x00000025 xor edx, edx 0x00000027 mov eax, ebx 0x00000029 mov ecx, 00000004h 0x0000002e div ecx 0x00000030 jmp 00007FF010BA7C0Eh 0x00000032 cmp dh, ah 0x00000034 cmp edx, 00000000h 0x00000037 jne 00007FF010BA7BA1h 0x00000039 movd mm3, ebx 0x0000003c jmp 00007FF010BA7C0Ah 0x0000003e pushad 0x0000003f mov edx, 00000023h 0x00000044 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
      Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 00000000024498E4 second address: 00000000024498EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
      Source: C:\Windows\SysWOW64\control.exeRDTSC instruction interceptor: First address: 0000000002449B5E second address: 0000000002449B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399799 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exe TID: 6656Thread sleep count: 192 > 30
      Source: C:\Windows\explorer.exe TID: 4860Thread sleep time: -54000s >= -30000s
      Source: C:\Windows\SysWOW64\control.exe TID: 6664Thread sleep time: -50000s >= -30000s
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: explorer.exe, 00000005.00000002.507545804.00000000053C4000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllsers\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db@
      Source: explorer.exe, 00000005.00000000.296937352.000000000891C000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00dRom0
      Source: explorer.exe, 00000005.00000000.281354355.0000000003710000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
      Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
      Source: explorer.exe, 00000005.00000000.281932971.000000000375B000.00000004.00000001.sdmpBinary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
      Source: explorer.exe, 00000005.00000000.282007162.0000000003767000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00
      Source: explorer.exe, 00000005.00000000.281932971.000000000375B000.00000004.00000001.sdmpBinary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
      Source: TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
      Source: explorer.exe, 00000005.00000002.495706634.00000000011B3000.00000004.00000020.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
      Source: explorer.exe, 00000005.00000000.297301925.00000000089B5000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
      Source: explorer.exe, 00000005.00000002.507545804.00000000053C4000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
      Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
      Source: TR-D45.pdf.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
      Source: explorer.exe, 00000005.00000000.297301925.00000000089B5000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
      Source: TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW@%
      Source: explorer.exe, 00000005.00000000.296192370.0000000008270000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess information queried: ProcessInformation

      Anti Debugging:

      barindex
      Contains functionality to hide a thread from the debuggerShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_0239071B NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,023908D5,00000000,00000000,00000000,00000000
      Hides threads from debuggersShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeThread information set: HideFromDebugger
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeThread information set: HideFromDebugger
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeThread information set: HideFromDebugger
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess queried: DebugPort
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess queried: DebugPort
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess queried: DebugPort
      Source: C:\Windows\SysWOW64\control.exeProcess queried: DebugPort
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02399799 rdtsc
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02395737 LdrInitializeThunk,
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023989D5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392372 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023941DF mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02398A59 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02398A97 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02398B37 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02398B03 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392B41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02397BBE mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_023989FF mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392F3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392F0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02392F8B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02396D27 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 0_2_02396D4F mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26E620 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E31FE3F mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E298E00 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A61C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321608 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27766D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E277E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32AE44 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E46A7 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E330EA5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FFE87 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2776E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2916E0 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338ED6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2936CC mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A8EC7 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E31FEC0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E264F2E mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29E730 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A70E mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33070D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28F716 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FFF10 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27FF60 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338F6A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27EF40 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E278794 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7794 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A37F5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29BC2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E321C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E33740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28746D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A44B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FC450 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27849B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3214FB mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338CD6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32E539 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E273D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26AD30 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2EA537 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28C577 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A3D43 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E3540 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E313D40 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E287D50 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2935A1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E291DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3305AC mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E262D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29FD9B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E318DF1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27D5E0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32FDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A4A2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E278A0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E283A1C mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E265210 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E265210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A927A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E31B260 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338A62 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32EA55 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2F4257 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2652A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27AAB0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29FAB0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29D294 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292AE4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292ACB mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32131B mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26DB60 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E293B7A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26DB40 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E338B58 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26F358 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E294BAD mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E335BA5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E271B8F mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E31D380 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E32138A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29B390 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292397 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28DBE9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2903E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E53CA mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E27B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E334015 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E322073 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E331074 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E280050 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2A90AF mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2920A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29F0BF mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29F0BF mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269080 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E3884 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2640E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2658EC mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2FB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E284120 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29513A mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E269100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26C962 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26B171 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28B944 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E69A6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2961A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2E51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E3249A4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E28C182 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E29A185 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E292990 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E2F41E8 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeCode function: 1_2_1E26B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446A44B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04450050 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04450050 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CC450 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CC450 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04501074 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445746D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F2073 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6C0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04504015 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04504015 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1C06 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B7016 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0450740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0450740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0450740D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446BC2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446002D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444B02A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04508CD6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CB8D0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044358EC mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F14FB mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6CF0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439080 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B3884 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B3884 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444849B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044620A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044790AF mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446F0BF mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446F0BF mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446F0BF mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445B944 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445B944 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04473D43 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B3540 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04457D50 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443C962 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443B171 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443B171 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445C577 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445C577 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439100 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04508D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04454120 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04443D34 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443AD30 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FE539 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446513A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446513A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044BA537 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04464D3B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B6DC9 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443B1E1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044C41E8 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444D5E0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444D5E0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FFDE2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044E8DF1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446A185 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445C182 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462581 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04432D8A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462990 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446FD9B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446FD9B mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044661A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044661A0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044635A1 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B69A6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04461DB5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044B51BE mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045005AC mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_045005AC mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04439240 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04447E41 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FAE44 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FAE44 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044FEA55 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044C4257 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0444766D mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044EB260 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044EB260 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04508A62 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0445AE73 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0447927A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443C600 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04468E00 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044F1608 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04448A0A mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04435210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04435210 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04435210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04435210 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443AA16 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04453A1C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446A61C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446A61C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0443E620 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04474A2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04474A2C mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044EFE3F mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04478EC7 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04508ED6 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044636CC mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462ACB mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044EFEC0 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_04462AE4 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044616E0 mov ecx, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044476E2 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044CFE87 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446D294 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_0446D294 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Windows\SysWOW64\control.exeCode function: 12_2_044352A5 mov eax, dword ptr fs:[00000030h]
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess token adjusted: Debug
      Source: C:\Windows\SysWOW64\control.exeProcess token adjusted: Debug

      HIPS / PFW / Operating System Protection Evasion:

      barindex
      System process connects to network (likely due to code injection or exploit)Show sources
      Source: C:\Windows\explorer.exeNetwork Connect: 54.147.194.143 80
      Source: C:\Windows\explorer.exeNetwork Connect: 34.102.136.180 80
      Maps a DLL or memory area into another processShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeSection loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeSection loaded: unknown target: C:\Windows\SysWOW64\control.exe protection: execute and read and write
      Source: C:\Windows\SysWOW64\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
      Source: C:\Windows\SysWOW64\control.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
      Modifies the context of a thread in another process (thread injection)Show sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeThread register set: target process: 3472
      Source: C:\Windows\SysWOW64\control.exeThread register set: target process: 3472
      Queues an APC in another process (thread injection)Show sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeThread APC queued: target process: C:\Windows\explorer.exe
      Sample uses process hollowing techniqueShow sources
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeSection unmapped: C:\Windows\SysWOW64\control.exe base address: 180000
      Source: C:\Users\user\Desktop\TR-D45.pdf.exeProcess created: C:\Users\user\Desktop\TR-D45.pdf.exe 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: C:\Windows\SysWOW64\control.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\TR-D45.pdf.exe'
      Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: explorer.exe, 00000005.00000000.278658305.0000000001128000.00000004.00000020.sdmpBinary or memory string: ProgmanOMEa
      Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: explorer.exe, 00000005.00000000.278878315.0000000001640000.00000002.00000001.sdmp, control.exe, 0000000C.00000002.495739945.0000000002CD0000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Stealing of Sensitive Information:

      barindex
      Yara detected FormBookShow sources
      Source: Yara matchFile source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY
      Yara detected Generic DropperShow sources
      Source: Yara matchFile source: Process Memory Space: control.exe PID: 6660, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: TR-D45.pdf.exe PID: 3668, type: MEMORY

      Remote Access Functionality:

      barindex
      Yara detected FormBookShow sources
      Source: Yara matchFile source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, type: MEMORY
      Source: Yara matchFile source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsShared Modules1Path InterceptionProcess Injection512Masquerading1Credential API Hooking1Security Software Discovery721Remote ServicesCredential API Hooking1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkit1LSASS MemoryVirtualization/Sandbox Evasion22Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion22Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection512NTDSRemote System Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol3SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsSystem Information Discovery31SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information13Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321007 Sample: TR-D45.pdf.exe Startdate: 20/11/2020 Architecture: WINDOWS Score: 100 29 g.msn.com 2->29 39 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 9 other signatures 2->45 11 TR-D45.pdf.exe 1 2->11         started        signatures3 process4 signatures5 55 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->55 57 Detected RDTSC dummy instruction sequence (likely for instruction hammering) 11->57 59 Tries to detect Any.run 11->59 61 3 other signatures 11->61 14 TR-D45.pdf.exe 6 11->14         started        process6 dnsIp7 37 pilatescollective.com 192.185.152.65, 443, 49718 UNIFIEDLAYER-AS-1US United States 14->37 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Tries to detect Any.run 14->65 67 Maps a DLL or memory area into another process 14->67 69 3 other signatures 14->69 18 explorer.exe 14->18 injected signatures8 process9 dnsIp10 31 gcvinternational.com 34.102.136.180, 49743, 80 GOOGLEUS United States 18->31 33 www.celebrations.sucks 54.147.194.143, 49745, 80 AMAZON-AESUS United States 18->33 35 2 other IPs or domains 18->35 47 System process connects to network (likely due to code injection or exploit) 18->47 22 control.exe 18->22         started        signatures11 process12 signatures13 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      TR-D45.pdf.exe29%VirustotalBrowse
      TR-D45.pdf.exe15%ReversingLabsWin32.Trojan.Bulz

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
      http://cps.letsencrypt.org00%URL Reputationsafe
      http://cps.letsencrypt.org00%URL Reputationsafe
      http://cps.letsencrypt.org00%URL Reputationsafe
      http://ocsp.int-x3.letsencrypt.org0/0%URL Reputationsafe
      http://ocsp.int-x3.letsencrypt.org0/0%URL Reputationsafe
      http://ocsp.int-x3.letsencrypt.org0/0%URL Reputationsafe
      http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB0%Avira URL Cloudsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.tiro.com0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.goodfont.co.kr0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.carterandcone.coml0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.sajatypeworks.com0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.typography.netD0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://fontfabrik.com0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.founder.com.cn/cn0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.sandoll.co.kr0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.urwpp.deDPlease0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.zhongyicts.com.cn0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.sakkal.com0%URL Reputationsafe
      http://www.gcvinternational.com/gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi0%Avira URL Cloudsafe
      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
      http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
      http://www.celebrations.sucks/gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      pilatescollective.com
      		192.185.152.65
      		truefalse
        		high
        www.celebrations.sucks
        		54.147.194.143
        		truetrue
          		unknown
          gcvinternational.com
          		34.102.136.180
          		truetrue
            		unknown
            www.gcvinternational.com
            		unknown
            		unknowntrue
              		unknown
              g.msn.com
              		unknown
              		unknownfalse
                		high
                www.montreynaud.com
                		unknown
                		unknowntrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://www.gcvinternational.com/gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTitrue
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.celebrations.sucks/gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkdtrue
                  • Avira URL Cloud: safe
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.apache.org/licenses/LICENSE-2.0explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                    		high
                    http://www.fontbureau.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                      		high
                      http://www.fontbureau.com/designersGexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                        		high
                        http://www.fontbureau.com/designers/?explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                          		high
                          http://www.founder.com.cn/cn/bTheexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://cps.letsencrypt.org0TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers?explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                            		high
                            https://pilatescollective.com/TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpfalse
                              		high
                              http://ocsp.int-x3.letsencrypt.org0/TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfBcontrol.exe, 0000000C.00000002.497562201.0000000004E2F000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.tiro.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designersexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                		high
                                https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin/TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmpfalse
                                  		high
                                  http://www.goodfont.co.krexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.binlTR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpfalse
                                    		high
                                    https://pilatescollective.com/D4TR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpfalse
                                      		high
                                      http://www.carterandcone.comlexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.sajatypeworks.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin=WyMTR-D45.pdf.exe, 00000001.00000002.314208350.0000000000887000.00000004.00000020.sdmpfalse
                                        		high
                                        http://www.typography.netDexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers/cabarga.htmlNexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                          		high
                                          http://www.founder.com.cn/cn/cTheexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.galapagosdesign.com/staff/dennis.htmexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://fontfabrik.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.founder.com.cn/cnexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.fontbureau.com/designers/frere-jones.htmlexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                            		high
                                            http://cert.int-x3.letsencrypt.org/0TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpfalse
                                              		high
                                              http://www.jiyu-kobo.co.jp/explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.bin7TR-D45.pdf.exe, 00000001.00000003.270384590.00000000008C0000.00000004.00000001.sdmpfalse
                                                		high
                                                http://www.galapagosdesign.com/DPleaseexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.com/designers8explorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                  		high
                                                  http://www.fonts.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                    		high
                                                    http://www.sandoll.co.krexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://pilatescollective.com/myguy/Edog_WaRWObtLyf156.binTR-D45.pdf.exefalse
                                                      		high
                                                      http://www.urwpp.deDPleaseexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.zhongyicts.com.cnexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.sakkal.comexplorer.exe, 00000005.00000000.299623008.000000000BC36000.00000002.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://cps.root-x1.letsencrypt.org0TR-D45.pdf.exe, 00000001.00000003.270393994.00000000008C5000.00000004.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      		unknown

                                                      Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      54.147.194.143
                                                      		unknownUnited States
                                                      		14618AMAZON-AESUStrue
                                                      34.102.136.180
                                                      		unknownUnited States
                                                      		15169GOOGLEUStrue
                                                      192.185.152.65
                                                      		unknownUnited States
                                                      		46606UNIFIEDLAYER-AS-1USfalse

                                                      General Information

                                                      Joe Sandbox Version:31.0.0 Red Diamond
                                                      Analysis ID:321007
                                                      Start date:20.11.2020
                                                      Start time:09:03:43
                                                      Joe Sandbox Product:CloudBasic
                                                      Overall analysis duration:0h 9m 11s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:light
                                                      Sample file name:TR-D45.pdf.exe
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                      Number of analysed new started processes analysed:23
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:1
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • HDC enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Detection:MAL
                                                      Classification:mal100.troj.spyw.evad.winEXE@7/0@8/3
                                                      EGA Information:Failed
                                                      HDC Information:
                                                      • Successful, ratio: 17.2% (good quality ratio 14.6%)
                                                      • Quality average: 68%
                                                      • Quality standard deviation: 34.3%
                                                      HCA Information:
                                                      • Successful, ratio: 94%
                                                      • Number of executed functions: 0
                                                      • Number of non-executed functions: 0
                                                      Cookbook Comments:
                                                      • Adjust boot time
                                                      • Enable AMSI
                                                      • Found application associated with file extension: .exe
                                                      Warnings:
                                                      Show All
                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
                                                      • TCP Packets have been reduced to 100
                                                      • Excluded IPs from analysis (whitelisted): 104.43.193.48, 92.122.144.200, 51.11.168.160, 104.43.139.144, 52.155.217.156, 52.177.165.30, 20.54.26.129, 52.142.114.176, 95.101.22.134, 95.101.22.125
                                                      • Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, bn3p.wns.notify.windows.com.akadns.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net
                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                      • Report size getting too big, too many NtQueryValueKey calls found.

                                                      Simulations

                                                      Behavior and APIs

                                                      No simulations

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      54.147.194.143Order specs19.11.20.exeGet hashmaliciousBrowse
                                                      • www.chantix.sucks/nwrr/?Rxo=L6hH4NIhfjzT&cj=uGPGvmJ2JHt21s4rgOafVTq/y3pY7yC+ILF7bn+N5+KqJxZXLHbImlswjI/oLvcp6/oghs0J3A==
                                                      DHL No_SINI0068206497.exeGet hashmaliciousBrowse
                                                      • www.crash.sucks/mkr/
                                                      Remittance Scan DOC-2029293#PI207-048.exeGet hashmaliciousBrowse
                                                      • www.delonghi.sucks/svh9/?rPXTJx=CJfJI9r1cBD0WydEqOpYnndytqZZCXXpDqaNH0BqxvDchJy8UsetUmnvuiU2wxntZNx4hJVMVg==&Lvyt=BZO03Fr
                                                      Payment Advice - Advice Ref[GLV824593835].exeGet hashmaliciousBrowse
                                                      • www.delonghi.sucks/svh9/?UN9hLV=EhL05l&9rQhv2=CJfJI9r1cBD0WydEqOpYnndytqZZCXXpDqaNH0BqxvDchJy8UsetUmnvuiY2jhruAdxu
                                                      34.102.136.18086dXpRWnFG.exeGet hashmaliciousBrowse
                                                      • www.powderedsilk.com/ogg/?FdtP=yL0l42d8z4u&JfspOLvH=fOCM8bU6nldV/iwSncfaF5Bzy/lGPGgo/g5DGIZRlu3EMk3UROnm6TGL4YPAlMSLjacD
                                                      LIST OF PRODUCTS NEEDED.exeGet hashmaliciousBrowse
                                                      • www.present-motherhood.com/pna/?oXN=7nbLudZHS&wP9=pAJh36KDGKuozQ+wlnL4iaUZacIoIbb12I26NWSsGNXaprJ2jX+VR1VHCYeoOV3CYcpo
                                                      Order specs19.11.20.exeGet hashmaliciousBrowse
                                                      • www.overstockalpine.com/nwrr/?cj=Nc1MB4yErYgRagn/HzK3hScSsYEBegMtx+kEQv9TefYD7E7OGiE02SCDOI6eM3Hv09tUJ3eV9Q==&Rxo=L6hH4NIhfjzT
                                                      Okwt8fW5KH.exeGet hashmaliciousBrowse
                                                      • www.mybriefbox.com/sdk/?AP=KzrxE&kzut2Pv=ieC5SQ4WTCMGwLwKeHkkTkUTO60lnbNinIRTqFa5Tgq0ajZ12E69OSpNqOiQRcX/surf
                                                      Purchase Order 40,7045.exeGet hashmaliciousBrowse
                                                      • www.onlineshoppingisbest.com/igqu/?YnztXrjp=cAw+48JGWTFWiF+zD75YoKcSRGv0/cbX2CyjAL3BYh15xmcIYagPiXPUr4/0BC838prH&sBZxwb=FxlXFP2PHdiD2
                                                      Payment Advice - Advice Ref GLV823990339.exeGet hashmaliciousBrowse
                                                      • www.brilliance-automation.com/gyo3/?Ez=XAbIWkmCD7FprhBGM/1VWQtkWKjPoo+hixDnJGBEsGUo9CkrVpkcDmC1vi0ujf808Qfd1id09g==&lhud=TjfdU2S
                                                      Purchase Order 40,7045$.exeGet hashmaliciousBrowse
                                                      • www.rockinglifefromhome.com/igqu/?afo=42cTP78OQQp4lToQAaTApkvzdS7tu3b97V7Z9hUZNPZ7GHRvcEVBBFWfORGuicEzVgEw0Hp6jQ==&DHU4SX=gbT8543hIhm
                                                      MV.KMTC JEBEL ALI_pdf.exeGet hashmaliciousBrowse
                                                      • www.mereziboutique.com/y9z/?uFQl=hX/JgwGUf2blPgyiHp8pkr0UcN4JhiEs10p3+69z9DK69Gln3SJoRK9DZHZ4ze7gp3+f&CTvp=fv10_lYhrxJtW6
                                                      SWIFT_HSBC Bank.exeGet hashmaliciousBrowse
                                                      • www.homewellliving.com/nt8e/?7nwltvxh=y2sdQ9Xb5ECC4UyPumlTTMs33wxYtaLvB/dO1hyuc+aLkGir7cEA1isigJn19hEFQwDS&org=3foxnfCXOnIhKD
                                                      23692 ANRITSU PROBE po 29288.exeGet hashmaliciousBrowse
                                                      • www.funeralfermentarium.com/9d1o/?lvH8U=Wears+I1XvB+Lmut0rGzY9wAFTAHH41k5OVIheQSGxmq0oO+QWZXKPOXziEsAnWJSQrEFn+Exw==&E6A=8pDxC4
                                                      PO0119-1620 LQSB 0320 Siemens.exeGet hashmaliciousBrowse
                                                      • www.guillermoastiazaran.com/sppe/?DnadT=x+bcW4Gq4Sa+8Fw3ruRe02HfSBDGbo9y1yLk6wxIyT1lxw5Q+sxUrgb1tDfRR28VG68C&DxlLi=2dmX
                                                      KYC_DOC_.EXEGet hashmaliciousBrowse
                                                      • www.packorganically.com/bw82/?CXrL=77CCBBr2/49gWL5yauZnKqdCED7z+VtJXat/kGRZ6Qnjpe6WQ1Ax9xdsmUB8H+4disGx&llvxw=fTAlUHeHDVNhYV
                                                      PO0119-1620 LQSB 0320 Siemens.exeGet hashmaliciousBrowse
                                                      • www.bullwingsgt.com/sppe/?00D=NB3Dd/vOM6aQ3m0lcddBYOe/MXAC8Z/KQ2ZGmCsq6hDofgl0Po6pPua8TNWmH6LR2TRn&w48H=qBZ83x7XYlyP0lo0
                                                      ant.exeGet hashmaliciousBrowse
                                                      • www.spidermenroofsupport.com/94sb/?8pMt5xHX=C9biJKOafB1QzsexO7xJmKpRIYJMQj6VpKItH4wgGF+KF++s1hKyu2EaSVFJqiHWuFvG&GzrT=Wb1LdRq8x
                                                      PROOF OF PAYMENT.exeGet hashmaliciousBrowse
                                                      • www.prideaffiliate.com/mua8/?w48t=0pY022IXUBwLfpfP&nflpdH=Vm4JrPClk0aQj+jhcdONVb3zc5GtcUOmsZyrOc+k5NW+jXUcqcFsSwfT9cazrXQd7qcZ
                                                      DEBIT NOTE DB-1130.exeGet hashmaliciousBrowse
                                                      • www.knotgardenlifestylings.com/ihm3/?sBZ4lrK=PS39z8PEw7TzfNOCiLKd1OXoS8/GfzxzB5O+ulo0NmPTjwXimFWvt/sJkvH86VVEya1bUCOS1g==&FPcT7b=djCDfFRXOP7H
                                                      POSH XANADU Order-SP-20-V241e.xlsxGet hashmaliciousBrowse
                                                      • www.desk-freely.com/dtn/?lb=tWjSWtdhKEbcvZcDY2Isxp7DhwPqmKrgqV2LL8a+7y46vKpMTXTGiWVbDe2Qat9zzYwG/g==&8ptdvJ=KT0pXTAPFjE0
                                                      PI 11172020.xlsxGet hashmaliciousBrowse
                                                      • www.yourpassionpurposepower.com/egem/?Ob20Lf_=T+Py0QdJSh8uop0xQluPGRTKd40I+j4T0iQ6z9ArmxF3ClsH1rswXmlXU/F87B5u4zxcgw==&BB6=L48xY
                                                      SHIPMENT DOCUMENT.xlsxGet hashmaliciousBrowse
                                                      • www.jesussavethelost.com/tlu/?ebc8=E2JdjN_822M&Kpjp=WL9elnUNGmLALDc/aT9Yvopy5IOc6bZx+8KB1+n4COxRyIg81J8N2lucSrbi65xgujJdpg==
                                                      Payment copy.docGet hashmaliciousBrowse
                                                      • www.bklynphotography.com/rtkc/?Lzut_=ltx8q4Ox&PBbXpL1=bE4nU21SxEXdYnFuZsah0rQhdxZ2NWbKsDNv4AQWUj+/+gwst6X3Stf0y64HfX7kmVIoow==

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      pilatescollective.comorder.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65

                                                      ASN

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      GOOGLEUSknitted yarn documents.exeGet hashmaliciousBrowse
                                                      • 172.253.120.109
                                                      86dXpRWnFG.exeGet hashmaliciousBrowse
                                                      • 34.102.136.180
                                                      https://kimiyasanattools.com/outlook/latest-onedrive/microsoft.phpGet hashmaliciousBrowse
                                                      • 172.217.16.130
                                                      b0408bca49c87f9e54bce76565bc6518.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      b2e3bd67d738988ca1bbed8d8b3e73fc.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      ad14f913dc65be569277c8c76de608a4.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      b2352353279664cc442f346015e86317.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      ab1671011f681ff09ac0ffd70fc4b92b.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      BetterPoints_v4.60.1_apkpure.com.apkGet hashmaliciousBrowse
                                                      • 216.58.212.163
                                                      b0e7416dbf03a7359e909c5bd68ae6e1.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      afaa3d5f10a2ea3c2813b3dd1dac8388.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      afbce292dbb11bda3b89b5ff8270bd20.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      aea80fb9d13561d7628b9d2f80a36ad0.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      af8eb3450867384ca855f2f0d0d6ae94.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      ae80b9b86323a612ce7a9c99f5cb65b4.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      ae85c1f45fb26bf61dc41c2a93d29b76.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      adf21651776b58545870cdcb1b2d955b.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      b2592f2f7a2eb53687b3a26249513d6e.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      ad167b5f4bd63100aeb68d12a0d87fae.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      aae68603d6527b50b950e95f13e20e08.exeGet hashmaliciousBrowse
                                                      • 74.125.34.46
                                                      UNIFIEDLAYER-AS-1USShipping Documents (INV,PL,BL)_pdf.exeGet hashmaliciousBrowse
                                                      • 192.185.170.106
                                                      Information-822908953.docGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      https://filmconsultancy.bindwall.ml/mike@filmconsultancy.comGet hashmaliciousBrowse
                                                      • 162.241.67.201
                                                      https://trondiamond.co/OMMOM/OM9u8Get hashmaliciousBrowse
                                                      • 162.241.67.195
                                                      https://app.box.com/s/gdf36roak3w2fc52cgfbxuq651p0zehyGet hashmaliciousBrowse
                                                      • 162.241.87.44
                                                      ef5ai1p.dllGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      http://septterror.tripod.com/the911basics.htmlGet hashmaliciousBrowse
                                                      • 192.254.236.192
                                                      Documentation.478396766.docGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      order.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      Documentation.478396766.docGet hashmaliciousBrowse
                                                      • 162.241.44.26
                                                      8OP0MEmSDd.dllGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      Information-478224510.docGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      ZcmAPc4xeE.dllGet hashmaliciousBrowse
                                                      • 162.241.44.26
                                                      7aKeSIV5Cu.dllGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      qRMGCk1u96.dllGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      qAm7u8G4lM.exeGet hashmaliciousBrowse
                                                      • 192.185.138.193
                                                      AWB# 9284730932.exeGet hashmaliciousBrowse
                                                      • 192.185.170.106
                                                      Document3327.xlsbGet hashmaliciousBrowse
                                                      • 198.57.244.39
                                                      POSH XANADU Order-SP-20093000-xlxs.xlsxGet hashmaliciousBrowse
                                                      • 192.185.144.204
                                                      dVcML4Zl0J.dllGet hashmaliciousBrowse
                                                      • 192.232.229.53
                                                      AMAZON-AESUSknitted yarn documents.exeGet hashmaliciousBrowse
                                                      • 23.21.126.66
                                                      BUILDING ORDER_PROPERTY SPECS.exeGet hashmaliciousBrowse
                                                      • 54.235.182.194
                                                      86dXpRWnFG.exeGet hashmaliciousBrowse
                                                      • 52.0.217.44
                                                      ano.exeGet hashmaliciousBrowse
                                                      • 23.21.42.25
                                                      kiiDjfpu2x.exeGet hashmaliciousBrowse
                                                      • 54.225.169.28
                                                      s5Hgh2z9mq.exeGet hashmaliciousBrowse
                                                      • 174.129.214.20
                                                      0hgHwEkIWY.exeGet hashmaliciousBrowse
                                                      • 54.225.169.28
                                                      CdmgSj4BO8.exeGet hashmaliciousBrowse
                                                      • 54.225.169.28
                                                      7PTbHgCUy6.exeGet hashmaliciousBrowse
                                                      • 54.225.169.28
                                                      DjP9Ogzsz8.exeGet hashmaliciousBrowse
                                                      • 54.225.169.28
                                                      rURZ9qp1cE.exeGet hashmaliciousBrowse
                                                      • 23.21.126.66
                                                      kaeHibiTa3.exeGet hashmaliciousBrowse
                                                      • 23.21.252.4
                                                      NYm3MN6z8D.exeGet hashmaliciousBrowse
                                                      • 23.21.126.66
                                                      sX1UqYq8cS.exeGet hashmaliciousBrowse
                                                      • 23.21.252.4
                                                      noaVP0hNm2.exeGet hashmaliciousBrowse
                                                      • 23.21.126.66
                                                      Swift Copy.exeGet hashmaliciousBrowse
                                                      • 23.21.252.4
                                                      https://smartdevappoffic.azurewebsites.net/qeBM8A4A6/WuZ2Y/FAjZdg5Nrw/@t1~RGCy/wefxc.php?bbre=d6266420d5a57cc3d73bcb5a9ec80cdeGet hashmaliciousBrowse
                                                      • 52.200.37.44
                                                      bossson2.exeGet hashmaliciousBrowse
                                                      • 54.225.153.147
                                                      https://t.e.vailresorts.com/r/?id=h1bac782d,59eb410,55e61f1&VRI_v73=96008558&cmpid=EML_OPENDAYS_RESO_000_OK_SR_REN1Y_000000_TG0001_20201118_V00_EX001_LOCA_ANN_00000_000Get hashmaliciousBrowse
                                                      • 100.25.209.179
                                                      REQUEST FOR QUOTATION-6container.exeGet hashmaliciousBrowse
                                                      • 54.243.161.145

                                                      JA3 Fingerprints

                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                      37f463bf4616ecd445d4a1937da06e19Shipping Documents (INV,PL,BL)_pdf.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://kimiyasanattools.com/outlook/latest-onedrive/microsoft.phpGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://filmconsultancy.bindwall.ml/mike@filmconsultancy.comGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://trondiamond.co/OMMOM/OM9u8Get hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://www.canva.com/design/DAEN9RlD8Vk/acBvt6UoL-DafjXmQk38pA/view?utm_content=DAEN9RlD8Vk&utm_campaign=designshare&utm_medium=link&utm_source=publishsharelinkGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://bit.ly/2UDM1ToGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://app.clio.com/link/AxWtfjmmzhjaGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      order.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      http://45.95.168.116Get hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://u7342898.ct.sendgrid.net/ls/click?upn=HCSIWZDf9Xl-2FB6XFKqg1zjEMCja-2BnYJ5hRYKkDjy2dSVqjHsLlv5ZMXJXnh9JLSzwabeBrvYMnX699odsYkKotv4jgW-2BTippSHf276Hpn3fz0kcusnYHGKND7vKQPAS7g42-2FTb5zb8CNq57r3z9Ilg-3D-3DWdrE_hNl5WjNXy0NQcJb9WqI7qh7uPLeU7UGDRahFCFKbQLS6qwym7zJ-2B-2BhWsSSLs8pHa1w9VDlWPsA7ahHsZZucjX2ktFkSy5vhVZT2L3Jxh6b-2FoboCHa2CJGLfF19s71-2FI3WPC7rECe-2BEO9fLwbfggsNq2V1-2FqgMhzgJQL411ZuD7Y8pECisPKLf0vf9WvB1fyVO9o6Euui31Jg3e-2FDialpg2CbkM21Us8J-2FBk13yWzh58-3DGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://carolearmstrongrealestate.com/wpe/14ea332d0684051d9fef033a5f1607dd?usr=cnBlbmRsZXRvbkBkYXRlc3dlaXNlci5jb20=Get hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      dde1df2ac5845a19823cabe182fcd870.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://prod.dfg152.ru/activate?key=23696252760045174930Get hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      dde1df2ac5845a19823cabe182fcd870.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      BYRkah8GsZ.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://www.canva.com/design/DAEN3YdYVHw/zaVHWoDx-9G9l20JXWSBtg/view?utm_content=DAEN3YdYVHw&utm_campaign=designshare&utm_medium=link&utm_source=sharebuttonGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      splwow64.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      NyUnwsFSCa.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      https://signup.kwikvpn.com/Get hashmaliciousBrowse
                                                      • 192.185.152.65
                                                      AWB# 9284730932.exeGet hashmaliciousBrowse
                                                      • 192.185.152.65

                                                      Dropped Files

                                                      No context

                                                      Created / dropped Files

                                                      No created / dropped files found

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                      Entropy (8bit):4.753776785310815
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.15%
                                                      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:TR-D45.pdf.exe
                                                      File size:86016
                                                      MD5:937841064411662c36469498ea645660
                                                      SHA1:7e72225620b06b6d9f5d54ee45ca2dd7ba10e87e
                                                      SHA256:3b162f2943b2ee8d6075b2f8f4cbd7832e11b50ecdfcb4a68cf18eb1c7614651
                                                      SHA512:5b5b035ab1829b2aaabce570767de93f77d07d291cf32df2d899b21b68bec3c66b77fc758f18b730161ddd7b22cf0b07c4efaeaa8d1917eae8073a6e52e7eac2
                                                      SSDEEP:768:dM21YSCVEWuYk96U1N+2gC3UGHNbdfJ+fQ2uepQc5408zZkOcG:hYSwuYk22gdyN2bueypaOZ
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......_.....................@......`........ ....@................

                                                      File Icon

                                                      Icon Hash:00d6d4ec71b24430

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x401360
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
                                                      DLL Characteristics:
                                                      Time Stamp:0x5FB6BE0B [Thu Nov 19 18:48:43 2020 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:4
                                                      OS Version Minor:0
                                                      File Version Major:4
                                                      File Version Minor:0
                                                      Subsystem Version Major:4
                                                      Subsystem Version Minor:0
                                                      Import Hash:0cb4f4ece3f5875b40d2bf4babdf78ef

                                                      Entrypoint Preview

                                                      Instruction
                                                      push 004039FCh
                                                      call 00007FF010A07145h
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      xor byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      inc eax
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add bl, ch
                                                      inc ebp
                                                      fdivrp st(2), st(0)
                                                      mov bh, CCh
                                                      mov ecx, 0FD68147h
                                                      sub al, 94h
                                                      insd
                                                      leave
                                                      lahf
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add dword ptr [eax], eax
                                                      add byte ptr [eax], al
                                                      and byte ptr [eax], ah
                                                      and byte ptr [eax], ah
                                                      and byte ptr [eax], ah
                                                      imul ebp, dword ptr [esi+66h], 6978656Ch
                                                      outsd
                                                      outsb
                                                      popad
                                                      insb
                                                      add byte ptr [esi+75h], ah
                                                      insb
                                                      outsb
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      dec esp
                                                      xor dword ptr [eax], eax
                                                      add dword ptr [eax+72BB315Ah], esp
                                                      int 73h
                                                      dec esp
                                                      mov ah, DEh
                                                      cli
                                                      and dword ptr [ebx+56B47994h], 03h
                                                      dec ecx
                                                      push esp
                                                      enter 4848h, A1h
                                                      mov al, 2Bh
                                                      xchg dword ptr [edi+3AD0135Dh], edi
                                                      dec edi
                                                      lodsd
                                                      xor ebx, dword ptr [ecx-48EE309Ah]
                                                      or al, 00h
                                                      stosb
                                                      add byte ptr [eax-2Dh], ah
                                                      xchg eax, ebx
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      add byte ptr [eax], al
                                                      dec eax
                                                      and eax, 25100000h
                                                      add byte ptr [eax], al
                                                      add byte ptr [6F635300h], cl
                                                      jc 00007FF010A071C0h
                                                      jne 000071BFh
                                                      outsb
                                                      jnc 00007FF010A071C6h
                                                      cmp byte ptr [eax], al
                                                      or eax, 55001101h

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x115b40x28.text
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x140000x15d8.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x10000xe4.text
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x109c40x11000False0.357579848346data5.29889463041IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                      .data0x120000x118c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                      .rsrc0x140000x15d80x2000False0.138427734375data1.78813993068IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountry
                                                      RT_ICON0x153f00x1e8data
                                                      RT_ICON0x14d280x6c8data
                                                      RT_ICON0x143a00x988data
                                                      RT_GROUP_ICON0x143700x30data
                                                      RT_VERSION0x141500x220dataGreekGreece

                                                      Imports

                                                      DLLImport
                                                      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaCastObjVar, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarDup, __vbaVarLateMemCallLd, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

                                                      Version Infos

                                                      DescriptionData
                                                      Translation0x0408 0x04b0
                                                      InternalNameSBEKASSEBILER
                                                      FileVersion2.00
                                                      CompanyNameGallup
                                                      ProductNameGallup
                                                      ProductVersion2.00
                                                      OriginalFilenameSBEKASSEBILER.exe

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      GreekGreece

                                                      Network Behavior

                                                      Snort IDS Alerts

                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                      11/20/20-09:05:53.419410TCP1201ATTACK-RESPONSES 403 Forbidden804974334.102.136.180192.168.2.5
                                                      11/20/20-09:06:40.687797ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.58.8.8.8
                                                      11/20/20-09:06:41.688704ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.58.8.8.8
                                                      11/20/20-09:06:43.702857ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.58.8.8.8

                                                      Network Port Distribution

                                                      TCP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 20, 2020 09:04:53.014657974 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.148817062 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.148917913 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.183671951 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.317677021 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.319329023 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.319369078 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.319391966 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.319427013 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.319459915 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.540272951 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.675340891 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.675415039 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.702871084 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.841784000 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841814995 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841834068 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841850042 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841865063 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841881990 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841897964 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841914892 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841932058 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841933012 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.841953993 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.841973066 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.841978073 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.841981888 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.842011929 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.975908995 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.975929022 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.975982904 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.975987911 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976001024 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976021051 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976035118 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976042032 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976061106 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976063967 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976078987 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976089954 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976095915 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976114035 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976126909 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976130009 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976147890 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976161957 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976165056 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976186991 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976186991 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976206064 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976216078 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976226091 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976243019 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976243973 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976259947 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976268053 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976278067 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976294994 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:53.976308107 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:53.976334095 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110428095 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110456944 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110474110 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110491037 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110508919 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110508919 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110522032 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110533953 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110547066 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110553026 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110560894 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110584021 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110603094 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110603094 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110620975 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110632896 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110637903 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110656023 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110660076 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110671997 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110688925 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110693932 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110706091 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110727072 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110739946 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110748053 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110757113 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110768080 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110780001 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110788107 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110794067 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110809088 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110821009 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110832930 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110846043 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110857964 CET49718443192.168.2.5192.185.152.65
                                                      Nov 20, 2020 09:04:54.110862970 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110876083 CET44349718192.185.152.65192.168.2.5
                                                      Nov 20, 2020 09:04:54.110888004 CET44349718192.185.152.65192.168.2.5

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Nov 20, 2020 09:04:29.703107119 CET5959653192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:29.730174065 CET53595968.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:30.566425085 CET6529653192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:30.601692915 CET53652968.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:31.407577991 CET6318353192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:31.434827089 CET53631838.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:34.731328964 CET6015153192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:34.758527994 CET53601518.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:42.050661087 CET5696953192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:42.077615976 CET53569698.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:52.822020054 CET5516153192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:52.981875896 CET53551618.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:53.127981901 CET5475753192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:53.166579008 CET53547578.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:53.743817091 CET4999253192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:53.772696018 CET53499928.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:55.063994884 CET6007553192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:55.099390984 CET53600758.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:04:58.159496069 CET5501653192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:04:58.186534882 CET53550168.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:07.165672064 CET6434553192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:07.201189995 CET53643458.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:19.018973112 CET5712853192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:19.054299116 CET53571288.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:19.603241920 CET5479153192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:19.640173912 CET53547918.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:20.127237082 CET5046353192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:20.162691116 CET53504638.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:20.655438900 CET5039453192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:20.692374945 CET53503948.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:21.174978018 CET5853053192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:21.212754965 CET53585308.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:21.804411888 CET5381353192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:21.840164900 CET53538138.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:22.555119991 CET6373253192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:22.590714931 CET53637328.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:23.129868984 CET5734453192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:23.166244984 CET53573448.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:24.209369898 CET5445053192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:24.244648933 CET53544508.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:25.874269962 CET5926153192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:25.909646034 CET53592618.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:27.315752029 CET5715153192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:27.343394995 CET53571518.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:27.647795916 CET5941353192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:27.690709114 CET53594138.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:30.082146883 CET6051653192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:30.126589060 CET53605168.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:30.557787895 CET5164953192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:30.594754934 CET53516498.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:05:53.221961021 CET6508653192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:05:53.273062944 CET53650868.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:01.685451031 CET5643253192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:01.715022087 CET53564328.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:15.634852886 CET5292953192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:15.769042015 CET53529298.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:34.651122093 CET6431753192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:35.659728050 CET6431753192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:36.660382986 CET6431753192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:38.675417900 CET6431753192.168.2.58.8.8.8
                                                      Nov 20, 2020 09:06:39.683166027 CET53643178.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:40.687666893 CET53643178.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:41.688621044 CET53643178.8.8.8192.168.2.5
                                                      Nov 20, 2020 09:06:43.702752113 CET53643178.8.8.8192.168.2.5

                                                      ICMP Packets

                                                      TimestampSource IPDest IPChecksumCodeType
                                                      Nov 20, 2020 09:06:40.687797070 CET192.168.2.58.8.8.8cff8(Port unreachable)Destination Unreachable
                                                      Nov 20, 2020 09:06:41.688704014 CET192.168.2.58.8.8.8cff8(Port unreachable)Destination Unreachable
                                                      Nov 20, 2020 09:06:43.702857018 CET192.168.2.58.8.8.8cff8(Port unreachable)Destination Unreachable

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                      Nov 20, 2020 09:04:52.822020054 CET192.168.2.58.8.8.80x9015Standard query (0)pilatescollective.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:05:30.082146883 CET192.168.2.58.8.8.80xc22eStandard query (0)g.msn.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:05:53.221961021 CET192.168.2.58.8.8.80x52e5Standard query (0)www.gcvinternational.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:15.634852886 CET192.168.2.58.8.8.80x5a49Standard query (0)www.celebrations.sucksA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:34.651122093 CET192.168.2.58.8.8.80xa44bStandard query (0)www.montreynaud.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:35.659728050 CET192.168.2.58.8.8.80xa44bStandard query (0)www.montreynaud.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:36.660382986 CET192.168.2.58.8.8.80xa44bStandard query (0)www.montreynaud.comA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:38.675417900 CET192.168.2.58.8.8.80xa44bStandard query (0)www.montreynaud.comA (IP address)IN (0x0001)

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                      Nov 20, 2020 09:04:52.981875896 CET8.8.8.8192.168.2.50x9015No error (0)pilatescollective.com192.185.152.65A (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:05:30.126589060 CET8.8.8.8192.168.2.50xc22eNo error (0)g.msn.comg-msn-com-nsatc.trafficmanager.netCNAME (Canonical name)IN (0x0001)
                                                      Nov 20, 2020 09:05:53.273062944 CET8.8.8.8192.168.2.50x52e5No error (0)www.gcvinternational.comgcvinternational.comCNAME (Canonical name)IN (0x0001)
                                                      Nov 20, 2020 09:05:53.273062944 CET8.8.8.8192.168.2.50x52e5No error (0)gcvinternational.com34.102.136.180A (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:15.769042015 CET8.8.8.8192.168.2.50x5a49No error (0)www.celebrations.sucks54.147.194.143A (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:39.683166027 CET8.8.8.8192.168.2.50xa44bServer failure (2)www.montreynaud.comnonenoneA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:40.687666893 CET8.8.8.8192.168.2.50xa44bServer failure (2)www.montreynaud.comnonenoneA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:41.688621044 CET8.8.8.8192.168.2.50xa44bServer failure (2)www.montreynaud.comnonenoneA (IP address)IN (0x0001)
                                                      Nov 20, 2020 09:06:43.702752113 CET8.8.8.8192.168.2.50xa44bServer failure (2)www.montreynaud.comnonenoneA (IP address)IN (0x0001)

                                                      HTTP Request Dependency Graph

                                                      • www.gcvinternational.com
                                                      • www.celebrations.sucks

                                                      HTTP Packets

                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                      0192.168.2.54974334.102.136.18080C:\Windows\explorer.exe
                                                      TimestampkBytes transferredDirectionData
                                                      Nov 20, 2020 09:05:53.298646927 CET5388OUTGET /gnu/?bly=TVIpcz004Rkd&X2MxIjJP=i4YBL42YhvK+usDHzss6Tj24XYATFEIvS7y0nzG29ZgEeNh3uLyKqQDd2VWk30ZHQtTi HTTP/1.1
                                                      Host: www.gcvinternational.com
                                                      Connection: close
                                                      Data Raw: 00 00 00 00 00 00 00
                                                      Data Ascii:
                                                      Nov 20, 2020 09:05:53.419409990 CET5389INHTTP/1.1 403 Forbidden
                                                      Server: openresty
                                                      Date: Fri, 20 Nov 2020 08:05:53 GMT
                                                      Content-Type: text/html
                                                      Content-Length: 275
                                                      ETag: "5fb6e13a-113"
                                                      Via: 1.1 google
                                                      Connection: close
                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                      Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>


                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                      1192.168.2.54974554.147.194.14380C:\Windows\explorer.exe
                                                      TimestampkBytes transferredDirectionData
                                                      Nov 20, 2020 09:06:15.873560905 CET5399OUTGET /gnu/?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd HTTP/1.1
                                                      Host: www.celebrations.sucks
                                                      Connection: close
                                                      Data Raw: 00 00 00 00 00 00 00
                                                      Data Ascii:
                                                      Nov 20, 2020 09:06:15.976310968 CET5400INHTTP/1.1 301 Moved Permanently
                                                      Date: Fri, 20 Nov 2020 08:06:15 GMT
                                                      Server: Apache/2.4.29 (Ubuntu)
                                                      Location: http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&bly=TVIpcz004Rkd
                                                      Content-Length: 428
                                                      Connection: close
                                                      Content-Type: text/html; charset=iso-8859-1
                                                      Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 63 65 6c 65 62 72 61 74 69 6f 6e 73 2e 73 75 63 6b 73 2f 67 6e 75 3f 58 32 4d 78 49 6a 4a 50 3d 63 6d 2f 76 5a 49 69 56 33 4f 73 30 71 39 6d 33 77 56 39 4e 41 59 6e 52 38 34 45 70 45 4b 32 57 2f 71 68 43 78 4a 4b 57 43 56 65 6b 31 31 6a 6e 4a 31 41 34 4d 49 4e 66 42 34 50 69 50 6a 35 43 58 67 68 45 26 61 6d 70 3b 62 6c 79 3d 54 56 49 70 63 7a 30 30 34 52 6b 64 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 63 65 6c 65 62 72 61 74 69 6f 6e 73 2e 73 75 63 6b 73 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                      Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://www.celebrations.sucks/gnu?X2MxIjJP=cm/vZIiV3Os0q9m3wV9NAYnR84EpEK2W/qhCxJKWCVek11jnJ1A4MINfB4PiPj5CXghE&amp;bly=TVIpcz004Rkd">here</a>.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.celebrations.sucks Port 80</address></body></html>


                                                      HTTPS Packets

                                                      TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                      Nov 20, 2020 09:04:53.319391966 CET192.185.152.65443192.168.2.549718CN=www.pilatescollective.com CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=USCN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Fri Nov 06 01:22:43 CET 2020 Thu Mar 17 17:40:46 CET 2016Thu Feb 04 01:22:43 CET 2021 Wed Mar 17 17:40:46 CET 2021771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,037f463bf4616ecd445d4a1937da06e19
                                                      CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Thu Mar 17 17:40:46 CET 2016Wed Mar 17 17:40:46 CET 2021

                                                      Code Manipulations

                                                      User Modules

                                                      Hook Summary

                                                      Function NameHook TypeActive in Processes
                                                      PeekMessageAINLINEexplorer.exe
                                                      PeekMessageWINLINEexplorer.exe
                                                      GetMessageWINLINEexplorer.exe
                                                      GetMessageAINLINEexplorer.exe

                                                      Processes

                                                      Process: explorer.exe, Module: user32.dll
                                                      Function NameHook TypeNew Data
                                                      PeekMessageAINLINE0x48 0x8B 0xB8 0x84 0x4E 0xEB
                                                      PeekMessageWINLINE0x48 0x8B 0xB8 0x8C 0xCE 0xEB
                                                      GetMessageWINLINE0x48 0x8B 0xB8 0x8C 0xCE 0xEB
                                                      GetMessageAINLINE0x48 0x8B 0xB8 0x84 0x4E 0xEB

                                                      Statistics

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      Analysis Process: TR-D45.pdf.exe PID: 6060 Parent PID: 5584

                                                      General

                                                      Start time:09:04:34
                                                      Start date:20/11/2020
                                                      Path:C:\Users\user\Desktop\TR-D45.pdf.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:'C:\Users\user\Desktop\TR-D45.pdf.exe'
                                                      Imagebase:0x400000
                                                      File size:86016 bytes
                                                      MD5 hash:937841064411662C36469498EA645660
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:Visual Basic
                                                      Reputation:low

                                                      Analysis Process: TR-D45.pdf.exe PID: 3668 Parent PID: 6060

                                                      General

                                                      Start time:09:04:42
                                                      Start date:20/11/2020
                                                      Path:C:\Users\user\Desktop\TR-D45.pdf.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:'C:\Users\user\Desktop\TR-D45.pdf.exe'
                                                      Imagebase:0x400000
                                                      File size:86016 bytes
                                                      MD5 hash:937841064411662C36469498EA645660
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, Author: Joe Security
                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.314014280.00000000000A0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, Author: Joe Security
                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.319831190.000000001E010000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                      Reputation:low

                                                      Analysis Process: explorer.exe PID: 3472 Parent PID: 3668

                                                      General

                                                      Start time:09:04:57
                                                      Start date:20/11/2020
                                                      Path:C:\Windows\explorer.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:
                                                      Imagebase:0x7ff693d90000
                                                      File size:3933184 bytes
                                                      MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high

                                                      Analysis Process: control.exe PID: 6660 Parent PID: 3472

                                                      General

                                                      Start time:09:05:11
                                                      Start date:20/11/2020
                                                      Path:C:\Windows\SysWOW64\control.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:C:\Windows\SysWOW64\control.exe
                                                      Imagebase:0x180000
                                                      File size:114688 bytes
                                                      MD5 hash:40FBA3FBFD5E33E0DE1BA45472FDA66F
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Yara matches:
                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, Author: Joe Security
                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.495604488.00000000028E0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                      • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 0000000C.00000002.495347185.00000000026CA000.00000004.00000020.sdmp, Author: Florian Roth
                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, Author: Joe Security
                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.495505278.00000000028B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                      • Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 0000000C.00000002.497491783.000000000493F000.00000004.00000001.sdmp, Author: Florian Roth
                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, Author: Joe Security
                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000C.00000002.495031806.0000000002440000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                                      Reputation:moderate

                                                      Analysis Process: cmd.exe PID: 6676 Parent PID: 6660

                                                      General

                                                      Start time:09:05:15
                                                      Start date:20/11/2020
                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                      Wow64 process (32bit):true
                                                      Commandline:/c del 'C:\Users\user\Desktop\TR-D45.pdf.exe'
                                                      Imagebase:0x150000
                                                      File size:232960 bytes
                                                      MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high

                                                      Analysis Process: conhost.exe PID: 6692 Parent PID: 6676

                                                      General

                                                      Start time:09:05:16
                                                      Start date:20/11/2020
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff7ecfc0000
                                                      File size:625664 bytes
                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high

                                                      Disassembly

                                                      Code Analysis

                                                      Reset < >