Analysis Report T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe

Overview

General Information

Sample Name: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Analysis ID: 411744
MD5: 306237cff93b7d61b1f72c400a9522e1
SHA1: aa8942a24452ac6e95feb05f1a5038d006f08c4d
SHA256: 4ffd8307eca6e6b382c035cb0ad32e52f37f9180e092764d6224d97557ef8ec9
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}
Multi AV Scanner detection for submitted file
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Virustotal: Detection: 34% Perma Link
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Metadefender: Detection: 38% Perma Link
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe ReversingLabs: Detection: 65%
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.681273392.0000000001070000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4x nop then pop ebx 4_2_00406A9A

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.rogegalmish.com/a8si/
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680325425.00000000025B1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comTC
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comV
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.comtigK&
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663739401.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662263041.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663430742.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers1
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersV0
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663769723.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersn
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.669067713.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersz0
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680256955.0000000000D07000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comgritan
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657228680.00000000058B5000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657286654.00000000058CB000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comn
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659151965.00000000058B5000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnTCV
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.664941588.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmn6
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659049481.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr.TTF
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.668655621.00000000058E5000.00000004.00000001.sdmp String found in binary or memory: http://www.monotT.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comY
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comlicB
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comn
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe String found in binary or memory: http://www.webstarmax.com/
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe String found in binary or memory: http://www.webstarmax.com/9mailto:office
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004181C0 NtCreateFile, 4_2_004181C0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00418270 NtReadFile, 4_2_00418270
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004182F0 NtClose, 4_2_004182F0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004183A0 NtAllocateVirtualMemory, 4_2_004183A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041826A NtReadFile, 4_2_0041826A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041839A NtAllocateVirtualMemory, 4_2_0041839A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_010D9860
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9660 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_010D9660
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D96E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_010D96E0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9910 NtAdjustPrivilegesToken, 4_2_010D9910
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9950 NtQueueApcThread, 4_2_010D9950
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D99A0 NtCreateSection, 4_2_010D99A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D99D0 NtCreateProcessEx, 4_2_010D99D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9820 NtEnumerateKey, 4_2_010D9820
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010DB040 NtSuspendThread, 4_2_010DB040
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9840 NtDelayExecution, 4_2_010D9840
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D98A0 NtWriteVirtualMemory, 4_2_010D98A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D98F0 NtReadVirtualMemory, 4_2_010D98F0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9B00 NtSetValueKey, 4_2_010D9B00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010DA3B0 NtGetContextThread, 4_2_010DA3B0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9A00 NtProtectVirtualMemory, 4_2_010D9A00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9A10 NtQuerySection, 4_2_010D9A10
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9A20 NtResumeThread, 4_2_010D9A20
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9A50 NtCreateFile, 4_2_010D9A50
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9A80 NtOpenDirectoryObject, 4_2_010D9A80
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9520 NtWaitForSingleObject, 4_2_010D9520
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010DAD30 NtSetContextThread, 4_2_010DAD30
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9540 NtReadFile, 4_2_010D9540
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9560 NtWriteFile, 4_2_010D9560
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D95D0 NtClose, 4_2_010D95D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D95F0 NtQueryInformationFile, 4_2_010D95F0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9710 NtQueryInformationToken, 4_2_010D9710
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010DA710 NtOpenProcessToken, 4_2_010DA710
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9730 NtQueryVirtualMemory, 4_2_010D9730
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9760 NtOpenProcess, 4_2_010D9760
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010DA770 NtOpenThread, 4_2_010DA770
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9770 NtSetInformationFile, 4_2_010D9770
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9780 NtMapViewOfSection, 4_2_010D9780
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D97A0 NtUnmapViewOfSection, 4_2_010D97A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9FE0 NtCreateMutant, 4_2_010D9FE0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9610 NtEnumerateValueKey, 4_2_010D9610
Detected potential crypto function
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_001E2C24 0_2_001E2C24
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_00CBA10C 0_2_00CBA10C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_00CBD4E8 0_2_00CBD4E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07388717 0_2_07388717
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07388965 0_2_07388965
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07384668 0_2_07384668
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07384657 0_2_07384657
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07383337 0_2_07383337
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_073883A0 0_2_073883A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07385BC0 0_2_07385BC0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07386210 0_2_07386210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07383210 0_2_07383210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0738620D 0_2_0738620D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_073832F9 0_2_073832F9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0738893E 0_2_0738893E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07384955 0_2_07384955
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07384148 0_2_07384148
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07384142 0_2_07384142
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_073889F3 0_2_073889F3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07383838 0_2_07383838
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0738001F 0_2_0738001F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07383808 0_2_07383808
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07380040 0_2_07380040
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07780610 0_2_07780610
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778A6F1 0_2_0778A6F1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07785EB0 0_2_07785EB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07780D78 0_2_07780D78
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07789568 0_2_07789568
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07789D61 0_2_07789D61
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07783D30 0_2_07783D30
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778B5C8 0_2_0778B5C8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778DD88 0_2_0778DD88
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_077863F4 0_2_077863F4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07786AD0 0_2_07786AD0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_077861C1 0_2_077861C1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778B754 0_2_0778B754
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778B7D5 0_2_0778B7D5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778D790 0_2_0778D790
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778D782 0_2_0778D782
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_0778B6E6 0_2_0778B6E6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07785EA1 0_2_07785EA1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00401030 4_2_00401030
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041C273 4_2_0041C273
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041BAA2 4_2_0041BAA2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00408C5B 4_2_00408C5B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00408C60 4_2_00408C60
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041BC22 4_2_0041BC22
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041CC24 4_2_0041CC24
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041B4A6 4_2_0041B4A6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041BD4F 4_2_0041BD4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041C501 4_2_0041C501
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00402D87 4_2_00402D87
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00402D90 4_2_00402D90
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041BDBD 4_2_0041BDBD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041BF3C 4_2_0041BF3C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041C7A5 4_2_0041C7A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00402FB0 4_2_00402FB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00622C24 4_2_00622C24
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109F900 4_2_0109F900
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B2990 4_2_010B2990
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AC1C0 4_2_010AC1C0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01096800 4_2_01096800
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151002 4_2_01151002
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116E824 4_2_0116E824
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA830 4_2_010BA830
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB090 4_2_010AB090
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011620A8 4_2_011620A8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011560F5 4_2_011560F5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011628EC 4_2_011628EC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115231B 4_2_0115231B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01162B28 4_2_01162B28
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BAB40 4_2_010BAB40
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113CB4F 4_2_0113CB4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B3360 4_2_010B3360
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C138B 4_2_010C138B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BEB9A 4_2_010BEB9A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113EB8A 4_2_0113EB8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CEBB0 4_2_010CEBB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115DBD2 4_2_0115DBD2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011503DA 4_2_011503DA
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CABD8 4_2_010CABD8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010E8BE8 4_2_010E8BE8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011423E3 4_2_011423E3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114FA2B 4_2_0114FA2B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01155A4F 4_2_01155A4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011622AE 4_2_011622AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011632A9 4_2_011632A9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115E2C5 4_2_0115E2C5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01162D07 4_2_01162D07
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01090D20 4_2_01090D20
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01161D55 4_2_01161D55
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B2D50 4_2_010B2D50
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2581 4_2_010C2581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C65A0 4_2_010C65A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011625DD 4_2_011625DD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AD5E0 4_2_010AD5E0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A841F 4_2_010A841F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B2430 4_2_010B2430
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115CC77 4_2_0115CC77
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115D466 4_2_0115D466
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB477 4_2_010BB477
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154496 4_2_01154496
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4CD4 4_2_010C4CD4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116DFCE 4_2_0116DFCE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01161FF1 4_2_01161FF1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011567E2 4_2_011567E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115D616 4_2_0115D616
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B5600 4_2_010B5600
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B6E30 4_2_010B6E30
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: String function: 010ED08C appears 44 times
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: String function: 01125720 appears 84 times
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: String function: 0109B150 appears 174 times
PE file contains strange resources
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.691734327.0000000006F80000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll( vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.692438491.00000000076D0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.679185423.00000000002BA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.682772982.000000000131F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000000.678183557.00000000006FA000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Binary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Uses 32bit PE files
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.log Jump to behavior
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Virustotal: Detection: 34%
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Metadefender: Detection: 38%
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe ReversingLabs: Detection: 65%
Source: unknown Process created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe 'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe'
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.681273392.0000000001070000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_00CB0438 pushad ; iretd 0_2_00CB043A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_00CB043F pushad ; iretd 0_2_00CB0442
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_00CBCB98 pushfd ; ret 0_2_00CBCB99
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07388AEE push esi; iretd 0_2_07388AF0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 0_2_07783652 push eax; retf 0_2_07783679
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004161E7 push edi; retf 4_2_004161E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004151B4 pushfd ; ret 4_2_004151D9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041B3B5 push eax; ret 4_2_0041B408
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041B46C push eax; ret 4_2_0041B472
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041B402 push eax; ret 4_2_0041B408
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041B40B push eax; ret 4_2_0041B472
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0041543B pushfd ; iretd 4_2_0041543E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_00415485 push edx; ret 4_2_00415496
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ED0D1 push ecx; ret 4_2_010ED0E4
Source: initial sample Static PE information: section name: .text entropy: 7.60293411131

Hooking and other Techniques for Hiding and Protection:

barindex
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: pdf.exe Static PE information: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 7028, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004088B0 rdtsc 4_2_004088B0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7072 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7032 Thread sleep time: -103866s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7064 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Thread delayed: delay time: 103866 Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: vmware
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_004088B0 rdtsc 4_2_004088B0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D9860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_010D9860
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099100 mov eax, dword ptr fs:[00000030h] 4_2_01099100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099100 mov eax, dword ptr fs:[00000030h] 4_2_01099100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099100 mov eax, dword ptr fs:[00000030h] 4_2_01099100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h] 4_2_010A0100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h] 4_2_010A0100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h] 4_2_010A0100
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h] 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h] 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h] 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h] 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B4120 mov ecx, dword ptr fs:[00000030h] 4_2_010B4120
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01093138 mov ecx, dword ptr fs:[00000030h] 4_2_01093138
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C513A mov eax, dword ptr fs:[00000030h] 4_2_010C513A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C513A mov eax, dword ptr fs:[00000030h] 4_2_010C513A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151951 mov eax, dword ptr fs:[00000030h] 4_2_01151951
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB944 mov eax, dword ptr fs:[00000030h] 4_2_010BB944
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB944 mov eax, dword ptr fs:[00000030h] 4_2_010BB944
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109395E mov eax, dword ptr fs:[00000030h] 4_2_0109395E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109395E mov eax, dword ptr fs:[00000030h] 4_2_0109395E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109C962 mov eax, dword ptr fs:[00000030h] 4_2_0109C962
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168966 mov eax, dword ptr fs:[00000030h] 4_2_01168966
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115E962 mov eax, dword ptr fs:[00000030h] 4_2_0115E962
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109B171 mov eax, dword ptr fs:[00000030h] 4_2_0109B171
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109B171 mov eax, dword ptr fs:[00000030h] 4_2_0109B171
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BC182 mov eax, dword ptr fs:[00000030h] 4_2_010BC182
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CA185 mov eax, dword ptr fs:[00000030h] 4_2_010CA185
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109519E mov eax, dword ptr fs:[00000030h] 4_2_0109519E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109519E mov ecx, dword ptr fs:[00000030h] 4_2_0109519E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01098190 mov ecx, dword ptr fs:[00000030h] 4_2_01098190
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2990 mov eax, dword ptr fs:[00000030h] 4_2_010C2990
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4190 mov eax, dword ptr fs:[00000030h] 4_2_010C4190
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115A189 mov eax, dword ptr fs:[00000030h] 4_2_0115A189
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115A189 mov ecx, dword ptr fs:[00000030h] 4_2_0115A189
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0116F1B5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116F1B5 mov eax, dword ptr fs:[00000030h] 4_2_0116F1B5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C61A0 mov eax, dword ptr fs:[00000030h] 4_2_010C61A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C61A0 mov eax, dword ptr fs:[00000030h] 4_2_010C61A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011151BE mov eax, dword ptr fs:[00000030h] 4_2_011151BE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011151BE mov eax, dword ptr fs:[00000030h] 4_2_011151BE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011151BE mov eax, dword ptr fs:[00000030h] 4_2_011151BE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011151BE mov eax, dword ptr fs:[00000030h] 4_2_011151BE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C99BC mov eax, dword ptr fs:[00000030h] 4_2_010C99BC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h] 4_2_011549A4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h] 4_2_011549A4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h] 4_2_011549A4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h] 4_2_011549A4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CC9BF mov eax, dword ptr fs:[00000030h] 4_2_010CC9BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CC9BF mov eax, dword ptr fs:[00000030h] 4_2_010CC9BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h] 4_2_010B99BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011169A6 mov eax, dword ptr fs:[00000030h] 4_2_011169A6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov ecx, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov ecx, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011531DC mov eax, dword ptr fs:[00000030h] 4_2_011531DC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AC1C0 mov eax, dword ptr fs:[00000030h] 4_2_010AC1C0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011519D8 mov eax, dword ptr fs:[00000030h] 4_2_011519D8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BD1EF mov eax, dword ptr fs:[00000030h] 4_2_010BD1EF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0109B1E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0109B1E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h] 4_2_0109B1E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010931E0 mov eax, dword ptr fs:[00000030h] 4_2_010931E0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011689E7 mov eax, dword ptr fs:[00000030h] 4_2_011689E7
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011241E8 mov eax, dword ptr fs:[00000030h] 4_2_011241E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01164015 mov eax, dword ptr fs:[00000030h] 4_2_01164015
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01164015 mov eax, dword ptr fs:[00000030h] 4_2_01164015
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01117016 mov eax, dword ptr fs:[00000030h] 4_2_01117016
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01117016 mov eax, dword ptr fs:[00000030h] 4_2_01117016
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01117016 mov eax, dword ptr fs:[00000030h] 4_2_01117016
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01096800 mov eax, dword ptr fs:[00000030h] 4_2_01096800
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01096800 mov eax, dword ptr fs:[00000030h] 4_2_01096800
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01096800 mov eax, dword ptr fs:[00000030h] 4_2_01096800
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h] 4_2_010AB02A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h] 4_2_010AB02A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h] 4_2_010AB02A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h] 4_2_010AB02A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C002D mov eax, dword ptr fs:[00000030h] 4_2_010C002D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C002D mov eax, dword ptr fs:[00000030h] 4_2_010C002D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C002D mov eax, dword ptr fs:[00000030h] 4_2_010C002D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C002D mov eax, dword ptr fs:[00000030h] 4_2_010C002D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C002D mov eax, dword ptr fs:[00000030h] 4_2_010C002D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4020 mov edi, dword ptr fs:[00000030h] 4_2_010C4020
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h] 4_2_010BA830
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h] 4_2_010BA830
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h] 4_2_010BA830
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h] 4_2_010BA830
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151843 mov eax, dword ptr fs:[00000030h] 4_2_01151843
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095050 mov eax, dword ptr fs:[00000030h] 4_2_01095050
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095050 mov eax, dword ptr fs:[00000030h] 4_2_01095050
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095050 mov eax, dword ptr fs:[00000030h] 4_2_01095050
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B0050 mov eax, dword ptr fs:[00000030h] 4_2_010B0050
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B0050 mov eax, dword ptr fs:[00000030h] 4_2_010B0050
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01097057 mov eax, dword ptr fs:[00000030h] 4_2_01097057
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01161074 mov eax, dword ptr fs:[00000030h] 4_2_01161074
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152073 mov eax, dword ptr fs:[00000030h] 4_2_01152073
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BF86D mov eax, dword ptr fs:[00000030h] 4_2_010BF86D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099080 mov eax, dword ptr fs:[00000030h] 4_2_01099080
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01093880 mov eax, dword ptr fs:[00000030h] 4_2_01093880
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01093880 mov eax, dword ptr fs:[00000030h] 4_2_01093880
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01113884 mov eax, dword ptr fs:[00000030h] 4_2_01113884
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01113884 mov eax, dword ptr fs:[00000030h] 4_2_01113884
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D90AF mov eax, dword ptr fs:[00000030h] 4_2_010D90AF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov ecx, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h] 4_2_010A28AE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h] 4_2_010C20A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF0BF mov ecx, dword ptr fs:[00000030h] 4_2_010CF0BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF0BF mov eax, dword ptr fs:[00000030h] 4_2_010CF0BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF0BF mov eax, dword ptr fs:[00000030h] 4_2_010CF0BF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov ecx, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0112B8D0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010970C0 mov eax, dword ptr fs:[00000030h] 4_2_010970C0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010970C0 mov eax, dword ptr fs:[00000030h] 4_2_010970C0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B0C7 mov eax, dword ptr fs:[00000030h] 4_2_0115B0C7
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B0C7 mov eax, dword ptr fs:[00000030h] 4_2_0115B0C7
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011518CA mov eax, dword ptr fs:[00000030h] 4_2_011518CA
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010978D6 mov eax, dword ptr fs:[00000030h] 4_2_010978D6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010978D6 mov eax, dword ptr fs:[00000030h] 4_2_010978D6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010978D6 mov ecx, dword ptr fs:[00000030h] 4_2_010978D6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h] 4_2_011560F5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h] 4_2_011560F5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h] 4_2_011560F5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h] 4_2_011560F5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010958EC mov eax, dword ptr fs:[00000030h] 4_2_010958EC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h] 4_2_010940E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h] 4_2_010940E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h] 4_2_010940E1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB8E4 mov eax, dword ptr fs:[00000030h] 4_2_010BB8E4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB8E4 mov eax, dword ptr fs:[00000030h] 4_2_010BB8E4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h] 4_2_010A28FD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h] 4_2_010A28FD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h] 4_2_010A28FD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h] 4_2_010BA309
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115131B mov eax, dword ptr fs:[00000030h] 4_2_0115131B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109DB40 mov eax, dword ptr fs:[00000030h] 4_2_0109DB40
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168B58 mov eax, dword ptr fs:[00000030h] 4_2_01168B58
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109F358 mov eax, dword ptr fs:[00000030h] 4_2_0109F358
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h] 4_2_010C3B5A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h] 4_2_010C3B5A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h] 4_2_010C3B5A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h] 4_2_010C3B5A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109DB60 mov ecx, dword ptr fs:[00000030h] 4_2_0109DB60
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B7A mov eax, dword ptr fs:[00000030h] 4_2_010C3B7A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3B7A mov eax, dword ptr fs:[00000030h] 4_2_010C3B7A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01126365 mov eax, dword ptr fs:[00000030h] 4_2_01126365
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01126365 mov eax, dword ptr fs:[00000030h] 4_2_01126365
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01126365 mov eax, dword ptr fs:[00000030h] 4_2_01126365
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01097B70 mov eax, dword ptr fs:[00000030h] 4_2_01097B70
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h] 4_2_010AF370
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h] 4_2_010AF370
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h] 4_2_010AF370
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A1B8F mov eax, dword ptr fs:[00000030h] 4_2_010A1B8F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A1B8F mov eax, dword ptr fs:[00000030h] 4_2_010A1B8F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C138B mov eax, dword ptr fs:[00000030h] 4_2_010C138B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C138B mov eax, dword ptr fs:[00000030h] 4_2_010C138B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C138B mov eax, dword ptr fs:[00000030h] 4_2_010C138B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BEB9A mov eax, dword ptr fs:[00000030h] 4_2_010BEB9A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BEB9A mov eax, dword ptr fs:[00000030h] 4_2_010BEB9A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114D380 mov ecx, dword ptr fs:[00000030h] 4_2_0114D380
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113EB8A mov ecx, dword ptr fs:[00000030h] 4_2_0113EB8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h] 4_2_0113EB8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h] 4_2_0113EB8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h] 4_2_0113EB8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2397 mov eax, dword ptr fs:[00000030h] 4_2_010C2397
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CB390 mov eax, dword ptr fs:[00000030h] 4_2_010CB390
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01094B94 mov edi, dword ptr fs:[00000030h] 4_2_01094B94
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115138A mov eax, dword ptr fs:[00000030h] 4_2_0115138A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168BB6 mov eax, dword ptr fs:[00000030h] 4_2_01168BB6
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h] 4_2_010C4BAD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h] 4_2_010C4BAD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h] 4_2_010C4BAD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01169BBE mov eax, dword ptr fs:[00000030h] 4_2_01169BBE
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01165BA5 mov eax, dword ptr fs:[00000030h] 4_2_01165BA5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151BA8 mov eax, dword ptr fs:[00000030h] 4_2_01151BA8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C53C5 mov eax, dword ptr fs:[00000030h] 4_2_010C53C5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011153CA mov eax, dword ptr fs:[00000030h] 4_2_011153CA
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011153CA mov eax, dword ptr fs:[00000030h] 4_2_011153CA
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01091BE9 mov eax, dword ptr fs:[00000030h] 4_2_01091BE9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BDBE9 mov eax, dword ptr fs:[00000030h] 4_2_010BDBE9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h] 4_2_010C03E2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011423E3 mov ecx, dword ptr fs:[00000030h] 4_2_011423E3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011423E3 mov ecx, dword ptr fs:[00000030h] 4_2_011423E3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011423E3 mov eax, dword ptr fs:[00000030h] 4_2_011423E3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A8A0A mov eax, dword ptr fs:[00000030h] 4_2_010A8A0A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115AA16 mov eax, dword ptr fs:[00000030h] 4_2_0115AA16
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115AA16 mov eax, dword ptr fs:[00000030h] 4_2_0115AA16
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov ecx, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h] 4_2_010ABA00
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B3A1C mov eax, dword ptr fs:[00000030h] 4_2_010B3A1C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095210 mov eax, dword ptr fs:[00000030h] 4_2_01095210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095210 mov ecx, dword ptr fs:[00000030h] 4_2_01095210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095210 mov eax, dword ptr fs:[00000030h] 4_2_01095210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095210 mov eax, dword ptr fs:[00000030h] 4_2_01095210
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109AA16 mov eax, dword ptr fs:[00000030h] 4_2_0109AA16
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109AA16 mov eax, dword ptr fs:[00000030h] 4_2_0109AA16
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D4A2C mov eax, dword ptr fs:[00000030h] 4_2_010D4A2C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D4A2C mov eax, dword ptr fs:[00000030h] 4_2_010D4A2C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h] 4_2_010BA229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01094A20 mov eax, dword ptr fs:[00000030h] 4_2_01094A20
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01094A20 mov eax, dword ptr fs:[00000030h] 4_2_01094A20
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01098239 mov eax, dword ptr fs:[00000030h] 4_2_01098239
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01098239 mov eax, dword ptr fs:[00000030h] 4_2_01098239
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01098239 mov eax, dword ptr fs:[00000030h] 4_2_01098239
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151229 mov eax, dword ptr fs:[00000030h] 4_2_01151229
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h] 4_2_010BB236
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115EA55 mov eax, dword ptr fs:[00000030h] 4_2_0115EA55
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01124257 mov eax, dword ptr fs:[00000030h] 4_2_01124257
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099240 mov eax, dword ptr fs:[00000030h] 4_2_01099240
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099240 mov eax, dword ptr fs:[00000030h] 4_2_01099240
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099240 mov eax, dword ptr fs:[00000030h] 4_2_01099240
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01099240 mov eax, dword ptr fs:[00000030h] 4_2_01099240
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151A5F mov eax, dword ptr fs:[00000030h] 4_2_01151A5F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h] 4_2_01155A4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h] 4_2_01155A4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h] 4_2_01155A4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h] 4_2_01155A4F
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h] 4_2_010D5A69
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h] 4_2_010D5A69
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h] 4_2_010D5A69
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114B260 mov eax, dword ptr fs:[00000030h] 4_2_0114B260
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114B260 mov eax, dword ptr fs:[00000030h] 4_2_0114B260
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168A62 mov eax, dword ptr fs:[00000030h] 4_2_01168A62
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D927A mov eax, dword ptr fs:[00000030h] 4_2_010D927A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CDA88 mov eax, dword ptr fs:[00000030h] 4_2_010CDA88
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CDA88 mov eax, dword ptr fs:[00000030h] 4_2_010CDA88
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115129A mov eax, dword ptr fs:[00000030h] 4_2_0115129A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CD294 mov eax, dword ptr fs:[00000030h] 4_2_010CD294
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CD294 mov eax, dword ptr fs:[00000030h] 4_2_010CD294
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01091AA0 mov eax, dword ptr fs:[00000030h] 4_2_01091AA0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h] 4_2_010952A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h] 4_2_010952A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h] 4_2_010952A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h] 4_2_010952A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h] 4_2_010952A5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C5AA0 mov eax, dword ptr fs:[00000030h] 4_2_010C5AA0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C5AA0 mov eax, dword ptr fs:[00000030h] 4_2_010C5AA0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C12BD mov esi, dword ptr fs:[00000030h] 4_2_010C12BD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C12BD mov eax, dword ptr fs:[00000030h] 4_2_010C12BD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C12BD mov eax, dword ptr fs:[00000030h] 4_2_010C12BD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AAAB0 mov eax, dword ptr fs:[00000030h] 4_2_010AAAB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AAAB0 mov eax, dword ptr fs:[00000030h] 4_2_010AAAB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CFAB0 mov eax, dword ptr fs:[00000030h] 4_2_010CFAB0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01093ACA mov eax, dword ptr fs:[00000030h] 4_2_01093ACA
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2ACB mov eax, dword ptr fs:[00000030h] 4_2_010C2ACB
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h] 4_2_01095AC0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h] 4_2_01095AC0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h] 4_2_01095AC0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168ADD mov eax, dword ptr fs:[00000030h] 4_2_01168ADD
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010912D4 mov eax, dword ptr fs:[00000030h] 4_2_010912D4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2AE4 mov eax, dword ptr fs:[00000030h] 4_2_010C2AE4
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h] 4_2_01154AEF
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h] 4_2_0115B2E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h] 4_2_0115B2E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h] 4_2_0115B2E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h] 4_2_0115B2E8
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01153518 mov eax, dword ptr fs:[00000030h] 4_2_01153518
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01153518 mov eax, dword ptr fs:[00000030h] 4_2_01153518
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01153518 mov eax, dword ptr fs:[00000030h] 4_2_01153518
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109751A mov eax, dword ptr fs:[00000030h] 4_2_0109751A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109751A mov eax, dword ptr fs:[00000030h] 4_2_0109751A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109751A mov eax, dword ptr fs:[00000030h] 4_2_0109751A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109751A mov eax, dword ptr fs:[00000030h] 4_2_0109751A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0113CD04 mov eax, dword ptr fs:[00000030h] 4_2_0113CD04
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168D34 mov eax, dword ptr fs:[00000030h] 4_2_01168D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0111A537 mov eax, dword ptr fs:[00000030h] 4_2_0111A537
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h] 4_2_010CF527
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h] 4_2_010CF527
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h] 4_2_010CF527
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115E539 mov eax, dword ptr fs:[00000030h] 4_2_0115E539
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h] 4_2_010C4D3B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h] 4_2_010C4D3B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h] 4_2_010C4D3B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109AD30 mov eax, dword ptr fs:[00000030h] 4_2_0109AD30
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h] 4_2_010A3D34
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109354C mov eax, dword ptr fs:[00000030h] 4_2_0109354C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0109354C mov eax, dword ptr fs:[00000030h] 4_2_0109354C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114FD52 mov eax, dword ptr fs:[00000030h] 4_2_0114FD52
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D3D43 mov eax, dword ptr fs:[00000030h] 4_2_010D3D43
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01113540 mov eax, dword ptr fs:[00000030h] 4_2_01113540
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01148D47 mov eax, dword ptr fs:[00000030h] 4_2_01148D47
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01143D40 mov eax, dword ptr fs:[00000030h] 4_2_01143D40
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B7D50 mov eax, dword ptr fs:[00000030h] 4_2_010B7D50
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D4D51 mov eax, dword ptr fs:[00000030h] 4_2_010D4D51
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010D4D51 mov eax, dword ptr fs:[00000030h] 4_2_010D4D51
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BC577 mov eax, dword ptr fs:[00000030h] 4_2_010BC577
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BC577 mov eax, dword ptr fs:[00000030h] 4_2_010BC577
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h] 4_2_010B8D76
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h] 4_2_010B8D76
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h] 4_2_010B8D76
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h] 4_2_010B8D76
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h] 4_2_010B8D76
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h] 4_2_01092D8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h] 4_2_01092D8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h] 4_2_01092D8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h] 4_2_01092D8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h] 4_2_01092D8A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h] 4_2_010C2581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h] 4_2_010C2581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h] 4_2_010C2581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h] 4_2_010C2581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h] 4_2_0115B581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h] 4_2_0115B581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h] 4_2_0115B581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h] 4_2_0115B581
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CFD9B mov eax, dword ptr fs:[00000030h] 4_2_010CFD9B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CFD9B mov eax, dword ptr fs:[00000030h] 4_2_010CFD9B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h] 4_2_01152D82
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01093591 mov eax, dword ptr fs:[00000030h] 4_2_01093591
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h] 4_2_010C65A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h] 4_2_010C65A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h] 4_2_010C65A0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C35A1 mov eax, dword ptr fs:[00000030h] 4_2_010C35A1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h] 4_2_010C1DB5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h] 4_2_010C1DB5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h] 4_2_010C1DB5
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011605AC mov eax, dword ptr fs:[00000030h] 4_2_011605AC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_011605AC mov eax, dword ptr fs:[00000030h] 4_2_011605AC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0114FDD3 mov eax, dword ptr fs:[00000030h] 4_2_0114FDD3
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010915C1 mov eax, dword ptr fs:[00000030h] 4_2_010915C1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov ecx, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h] 4_2_01116DC9
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C95EC mov eax, dword ptr fs:[00000030h] 4_2_010C95EC
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01148DF1 mov eax, dword ptr fs:[00000030h] 4_2_01148DF1
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AD5E0 mov eax, dword ptr fs:[00000030h] 4_2_010AD5E0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AD5E0 mov eax, dword ptr fs:[00000030h] 4_2_010AD5E0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0115FDE2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0115FDE2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0115FDE2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0115FDE2
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010995F0 mov eax, dword ptr fs:[00000030h] 4_2_010995F0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010995F0 mov ecx, dword ptr fs:[00000030h] 4_2_010995F0
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168C14 mov eax, dword ptr fs:[00000030h] 4_2_01168C14
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h] 4_2_01151C06
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01098410 mov eax, dword ptr fs:[00000030h] 4_2_01098410
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116740D mov eax, dword ptr fs:[00000030h] 4_2_0116740D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116740D mov eax, dword ptr fs:[00000030h] 4_2_0116740D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0116740D mov eax, dword ptr fs:[00000030h] 4_2_0116740D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h] 4_2_01116C0A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h] 4_2_01116C0A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h] 4_2_01116C0A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h] 4_2_01116C0A
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CBC2C mov eax, dword ptr fs:[00000030h] 4_2_010CBC2C
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01094439 mov eax, dword ptr fs:[00000030h] 4_2_01094439
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h] 4_2_010C3C3E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h] 4_2_010C3C3E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h] 4_2_010C3C3E
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h] 4_2_010AB433
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h] 4_2_010AB433
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h] 4_2_010AB433
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B2430 mov eax, dword ptr fs:[00000030h] 4_2_010B2430
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B2430 mov eax, dword ptr fs:[00000030h] 4_2_010B2430
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112C450 mov eax, dword ptr fs:[00000030h] 4_2_0112C450
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_0112C450 mov eax, dword ptr fs:[00000030h] 4_2_0112C450
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168450 mov eax, dword ptr fs:[00000030h] 4_2_01168450
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CA44B mov eax, dword ptr fs:[00000030h] 4_2_010CA44B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_01168C75 mov eax, dword ptr fs:[00000030h] 4_2_01168C75
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010B746D mov eax, dword ptr fs:[00000030h] 4_2_010B746D
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h] 4_2_010CAC7B
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h] 4_2_010BB477
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h] 4_2_010BB477
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Code function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h] 4_2_010BB477
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Memory written: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Process created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 411744 Sample: T31597760-Confirm-20210507-... Startdate: 12/05/2021 Architecture: WINDOWS Score: 100 14 Found malware configuration 2->14 16 Malicious sample detected (through community Yara rule) 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 7 other signatures 2->20 6 T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe 3 2->6         started        process3 file4 12 T31597760-Confirm-...1574401.PDF.exe.log, ASCII 6->12 dropped 22 Tries to detect virtualization through RDTSC time measurements 6->22 24 Injects a PE file into a foreign processes 6->24 10 T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe 6->10         started        signatures5 process6
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.rogegalmish.com/a8si/ true
  • 3%, Virustotal, Browse
  • Avira URL Cloud: safe
 low