Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe

Overview

General Information

Sample Name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Analysis ID:411744
MD5:306237cff93b7d61b1f72c400a9522e1
SHA1:aa8942a24452ac6e95feb05f1a5038d006f08c4d
SHA256:4ffd8307eca6e6b382c035cb0ad32e52f37f9180e092764d6224d97557ef8ec9
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x9a1d8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x9a572:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0xc15f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0xc1992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0xa6285:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0xcd6a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0xa5d71:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0xcd191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0xa6387:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0xcd7a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0xa64ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xcd91f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x9af8a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0xc23aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0xa4fec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xcc40c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x9bd02:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0xc3122:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0xab377:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0xd2797:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0xac41a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0xa82a9:$sqlite3step: 68 34 1C 7B E1
    • 0xa83bc:$sqlite3step: 68 34 1C 7B E1
    • 0xcf6c9:$sqlite3step: 68 34 1C 7B E1
    • 0xcf7dc:$sqlite3step: 68 34 1C 7B E1
    • 0xa82d8:$sqlite3text: 68 38 2A 90 C5
    • 0xa83fd:$sqlite3text: 68 38 2A 90 C5
    • 0xcf6f8:$sqlite3text: 68 38 2A 90 C5
    • 0xcf81d:$sqlite3text: 68 38 2A 90 C5
    • 0xa82eb:$sqlite3blob: 68 53 D8 7F 8C
    • 0xa8413:$sqlite3blob: 68 53 D8 7F 8C
    • 0xcf70b:$sqlite3blob: 68 53 D8 7F 8C
    • 0xcf833:$sqlite3blob: 68 53 D8 7F 8C
    00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 3 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x158b9:$sqlite3step: 68 34 1C 7B E1
        • 0x159cc:$sqlite3step: 68 34 1C 7B E1
        • 0x158e8:$sqlite3text: 68 38 2A 90 C5
        • 0x15a0d:$sqlite3text: 68 38 2A 90 C5
        • 0x158fb:$sqlite3blob: 68 53 D8 7F 8C
        • 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
        4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 1 entries

          Sigma Overview

          System Summary:

          barindex
          Sigma detected: Suspicious Double ExtensionShow sources
          Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, CommandLine: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, NewProcessName: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, OriginalFileName: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe' , ParentImage: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ParentProcessId: 7028, ProcessCommandLine: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ProcessId: 4164

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeVirustotal: Detection: 34%Perma Link
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMetadefender: Detection: 38%Perma Link
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeReversingLabs: Detection: 65%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.681273392.0000000001070000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4x nop then pop ebx

          Networking:

          barindex
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.rogegalmish.com/a8si/
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680325425.00000000025B1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comTC
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comV
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comtigK&
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663739401.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662263041.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663430742.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers1
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersV0
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663769723.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersn
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.669067713.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersz0
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680256955.0000000000D07000.00000004.00000040.sdmpString found in binary or memory: http://www.fontbureau.comgritan
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657228680.00000000058B5000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657286654.00000000058CB000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comn
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659151965.00000000058B5000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnTCV
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.664941588.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmn6
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659049481.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr.TTF
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.668655621.00000000058E5000.00000004.00000001.sdmpString found in binary or memory: http://www.monotT.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comY
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comlicB
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comn
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeString found in binary or memory: http://www.webstarmax.com/
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeString found in binary or memory: http://www.webstarmax.com/9mailto:office
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004181C0 NtCreateFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00418270 NtReadFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004182F0 NtClose,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004183A0 NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041826A NtReadFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041839A NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D96E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9910 NtAdjustPrivilegesToken,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9950 NtQueueApcThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D99A0 NtCreateSection,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D99D0 NtCreateProcessEx,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9820 NtEnumerateKey,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010DB040 NtSuspendThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9840 NtDelayExecution,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D98A0 NtWriteVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D98F0 NtReadVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9B00 NtSetValueKey,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010DA3B0 NtGetContextThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9A00 NtProtectVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9A10 NtQuerySection,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9A20 NtResumeThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9A50 NtCreateFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9A80 NtOpenDirectoryObject,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9520 NtWaitForSingleObject,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010DAD30 NtSetContextThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9540 NtReadFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9560 NtWriteFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D95D0 NtClose,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D95F0 NtQueryInformationFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9710 NtQueryInformationToken,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010DA710 NtOpenProcessToken,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9730 NtQueryVirtualMemory,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9760 NtOpenProcess,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010DA770 NtOpenThread,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9770 NtSetInformationFile,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9780 NtMapViewOfSection,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D97A0 NtUnmapViewOfSection,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9FE0 NtCreateMutant,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9610 NtEnumerateValueKey,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_001E2C24
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_00CBA10C
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_00CBD4E8
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07388717
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07388965
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07384668
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07384657
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07383337
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_073883A0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07385BC0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07386210
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07383210
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0738620D
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_073832F9
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0738893E
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07384955
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07384148
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07384142
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_073889F3
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07383838
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0738001F
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07383808
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07380040
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07780610
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778A6F1
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07785EB0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07780D78
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07789568
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07789D61
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07783D30
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778B5C8
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778DD88
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_077863F4
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07786AD0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_077861C1
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778B754
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778B7D5
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778D790
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778D782
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0778B6E6
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07785EA1
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00401030
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041C273
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041BAA2
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00408C5B
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00408C60
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041BC22
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041CC24
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041B4A6
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041BD4F
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041C501
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00402D87
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00402D90
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041BDBD
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041BF3C
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041C7A5
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00402FB0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00622C24
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109F900
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B2990
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AC1C0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01096800
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151002
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116E824
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA830
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB090
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011620A8
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011560F5
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011628EC
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115231B
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01162B28
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BAB40
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113CB4F
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B3360
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C138B
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BEB9A
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113EB8A
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CEBB0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115DBD2
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011503DA
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CABD8
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010E8BE8
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011423E3
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114FA2B
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01155A4F
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011622AE
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011632A9
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115E2C5
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01162D07
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01090D20
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01161D55
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B2D50
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2581
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C65A0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011625DD
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AD5E0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A841F
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B2430
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115CC77
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115D466
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB477
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154496
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4CD4
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116DFCE
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01161FF1
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011567E2
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115D616
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B5600
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B6E30
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 010ED08C appears 44 times
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 01125720 appears 84 times
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 0109B150 appears 174 times
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.691734327.0000000006F80000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.692438491.00000000076D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.679185423.00000000002BA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.682772982.000000000131F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000000.678183557.00000000006FA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeBinary or memory string: OriginalFilenameMemberFilter.exe< vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: classification engineClassification label: mal100.troj.evad.winEXE@3/1@0/0
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.logJump to behavior
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeVirustotal: Detection: 34%
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMetadefender: Detection: 38%
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeReversingLabs: Detection: 65%
          Source: unknownProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe 'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe'
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000004.00000002.681273392.0000000001070000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_00CB0438 pushad ; iretd
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_00CB043F pushad ; iretd
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_00CBCB98 pushfd ; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07388AEE push esi; iretd
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_07783652 push eax; retf
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004161E7 push edi; retf
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004151B4 pushfd ; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041B3B5 push eax; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041B46C push eax; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041B402 push eax; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041B40B push eax; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0041543B pushfd ; iretd
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_00415485 push edx; ret
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ED0D1 push ecx; ret
          Source: initial sampleStatic PE information: section name: .text entropy: 7.60293411131

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Uses an obfuscated file name to hide its real file extension (double extension)Show sources
          Source: Possible double extension: pdf.exeStatic PE information: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion:

          barindex
          Yara detected AntiVM3Show sources
          Source: Yara matchFile source: 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 7028, type: MEMORY
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeRDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeRDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004088B0 rdtsc
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7072Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7032Thread sleep time: -103866s >= -30000s
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 7064Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 103866
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: vmware
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: VMWARE
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
          Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.685991033.00000000055F0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_004088B0 rdtsc
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D9860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A0100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B4120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01093138 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151951 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109395E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109395E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168966 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115E962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BC182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CA185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109519E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109519E mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01098190 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4190 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115A189 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115A189 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116F1B5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116F1B5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011151BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011151BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011151BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011151BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C99BC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011549A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CC9BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CC9BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B99BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011169A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011531DC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AC1C0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011519D8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BD1EF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010931E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011689E7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011241E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01164015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01164015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01117016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01117016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01117016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01096800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01096800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01096800 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4020 mov edi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151843 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B0050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B0050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01097057 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01161074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BF86D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01093880 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01093880 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01113884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01113884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D90AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28AE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010970C0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010970C0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B0C7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B0C7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011518CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010978D6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010978D6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010978D6 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011560F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010958EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010940E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A28FD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA309 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B5A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01126365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01126365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01126365 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01097B70 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AF370 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A1B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A1B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C138B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BEB9A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BEB9A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114D380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113EB8A mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113EB8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CB390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01094B94 mov edi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168BB6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01169BBE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01165BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151BA8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C53C5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011153CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011153CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01091BE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BDBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011423E3 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011423E3 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011423E3 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A8A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010ABA00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B3A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D4A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D4A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BA229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01094A20 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01094A20 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01098239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01098239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01098239 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB236 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115EA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01124257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01099240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151A5F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01155A4F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D5A69 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CDA88 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CDA88 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115129A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01091AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010952A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C5AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C5AA0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C12BD mov esi, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C12BD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C12BD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AAAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AAAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CFAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01093ACA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01095AC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168ADD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010912D4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01154AEF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B2E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01153518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01153518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01153518 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109751A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109751A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109751A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109751A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0113CD04 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0111A537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CF527 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115E539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010A3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109354C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0109354C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114FD52 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D3D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01113540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01148D47 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01143D40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B7D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D4D51 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010D4D51 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BC577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BC577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B8D76 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01092D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115B581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01152D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01093591 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C65A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C35A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011605AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_011605AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0114FDD3 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010915C1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C95EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01148DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AD5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AD5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0115FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010995F0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010995F0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168C14 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01151C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01098410 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0116740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01116C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CBC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01094439 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010C3C3E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010AB433 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B2430 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B2430 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_0112C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CA44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_01168C75 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010B746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010CAC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4_2_010BB477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          Injects a PE file into a foreign processesShow sources
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMemory written: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe base: 400000 value starts with: 4D5A
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading11OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information14Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe34%VirustotalBrowse
          T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe44%MetadefenderBrowse
          T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe66%ReversingLabsByteCode-MSIL.Trojan.AgentTesla

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          4.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          www.rogegalmish.com/a8si/3%VirustotalBrowse
          www.rogegalmish.com/a8si/0%Avira URL Cloudsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htmn60%Avira URL Cloudsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr.TTF0%Avira URL Cloudsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.carterandcone.com.0%URL Reputationsafe
          http://www.carterandcone.com.0%URL Reputationsafe
          http://www.carterandcone.com.0%URL Reputationsafe
          http://www.carterandcone.com.0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.founder.com.cn/cnTCV0%Avira URL Cloudsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.fontbureau.comgritan0%Avira URL Cloudsafe
          http://www.tiro.comlicB0%Avira URL Cloudsafe
          http://www.fonts.comn0%URL Reputationsafe
          http://www.fonts.comn0%URL Reputationsafe
          http://www.fonts.comn0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.carterandcone.comV0%Avira URL Cloudsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.webstarmax.com/0%Avira URL Cloudsafe
          http://www.monotT.0%Avira URL Cloudsafe
          http://www.carterandcone.comTC0%URL Reputationsafe
          http://www.carterandcone.comTC0%URL Reputationsafe
          http://www.carterandcone.comTC0%URL Reputationsafe
          http://www.tiro.comn0%URL Reputationsafe
          http://www.tiro.comn0%URL Reputationsafe
          http://www.tiro.comn0%URL Reputationsafe
          http://www.webstarmax.com/9mailto:office0%Avira URL Cloudsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.goodfont.0%Avira URL Cloudsafe
          http://www.tiro.comY0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.carterandcone.comtigK&0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          No contacted domains info

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          www.rogegalmish.com/a8si/true
          • 3%, Virustotal, Browse
          • Avira URL Cloud: safe
          		low

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://www.fontbureau.com/designersGT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
            		high
            http://www.fontbureau.com/designers/?T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
              		high
              http://www.founder.com.cn/cn/bTheT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              • URL Reputation: safe
              		unknown
              http://www.fontbureau.com/designers?T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                		high
                http://www.galapagosdesign.com/staff/dennis.htmn6T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.664941588.00000000058E5000.00000004.00000001.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://www.tiro.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                • URL Reputation: safe
                		unknown
                http://www.fontbureau.com/designersT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663739401.00000000058E5000.00000004.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662263041.00000000058E5000.00000004.00000001.sdmpfalse
                  		high
                  http://www.goodfont.co.kr.TTFT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.goodfont.co.krT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  http://www.carterandcone.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  • URL Reputation: safe
                  		unknown
                  https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmpfalse
                    		high
                    http://www.carterandcone.com.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660140019.00000000058B2000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designersz0T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.669067713.00000000058E5000.00000004.00000001.sdmpfalse
                      		high
                      http://www.sajatypeworks.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.typography.netDT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.founder.com.cn/cn/cTheT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.founder.com.cn/cnTCVT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.658694270.00000000058B2000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.galapagosdesign.com/staff/dennis.htmT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://fontfabrik.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.comgritanT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680256955.0000000000D07000.00000004.00000040.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.tiro.comlicBT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fonts.comnT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657286654.00000000058CB000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.galapagosdesign.com/DPleaseT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      		unknown
                      http://www.carterandcone.comVT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fonts.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657228680.00000000058B5000.00000004.00000001.sdmpfalse
                        		high
                        http://www.sandoll.co.krT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.urwpp.deDPleaseT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.zhongyicts.com.cnT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.680325425.00000000025B1000.00000004.00000001.sdmpfalse
                          		high
                          http://www.sakkal.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designersnT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663769723.00000000058E5000.00000004.00000001.sdmpfalse
                            		high
                            http://www.apache.org/licenses/LICENSE-2.0T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                              		high
                              http://www.fontbureau.comT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                		high
                                http://www.webstarmax.com/T31597760-Confirm-20210507-100016-Email-1574401.PDF.exefalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.monotT.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.668655621.00000000058E5000.00000004.00000001.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.carterandcone.comTCT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.tiro.comnT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.657480728.00000000058CB000.00000004.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.webstarmax.com/9mailto:officeT31597760-Confirm-20210507-100016-Email-1574401.PDF.exefalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.carterandcone.comlT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                • URL Reputation: safe
                                • URL Reputation: safe
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/cabarga.htmlNT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.founder.com.cn/cnT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmp, T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659151965.00000000058B5000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers/frere-user.htmlT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.goodfont.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659049481.00000000058B2000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.tiro.comYT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.660255920.00000000058B2000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.jiyu-kobo.co.jp/T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.fontbureau.com/designers8T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.687314996.00000000059A0000.00000002.00000001.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designersV0T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.662560278.00000000058E5000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.fontbureau.com/designers1T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.663430742.00000000058E5000.00000004.00000001.sdmpfalse
                                          		high
                                          http://www.carterandcone.comtigK&T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000003.659592367.00000000058ED000.00000004.00000001.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		low

                                          Contacted IPs

                                          No contacted IP infos

                                          General Information

                                          Joe Sandbox Version:32.0.0 Black Diamond
                                          Analysis ID:411744
                                          Start date:12.05.2021
                                          Start time:06:07:19
                                          Joe Sandbox Product:CloudBasic
                                          Overall analysis duration:0h 8m 9s
                                          Hypervisor based Inspection enabled:false
                                          Report type:light
                                          Sample file name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          Cookbook file name:default.jbs
                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                          Number of analysed new started processes analysed:20
                                          Number of new started drivers analysed:0
                                          Number of existing processes analysed:0
                                          Number of existing drivers analysed:0
                                          Number of injected processes analysed:0
                                          Technologies:
                                          • HCA enabled
                                          • EGA enabled
                                          • HDC enabled
                                          • AMSI enabled
                                          Analysis Mode:default
                                          Analysis stop reason:Timeout
                                          Detection:MAL
                                          Classification:mal100.troj.evad.winEXE@3/1@0/0
                                          EGA Information:Failed
                                          HDC Information:
                                          • Successful, ratio: 2.6% (good quality ratio 2.5%)
                                          • Quality average: 73.9%
                                          • Quality standard deviation: 29.6%
                                          HCA Information:
                                          • Successful, ratio: 97%
                                          • Number of executed functions: 0
                                          • Number of non-executed functions: 0
                                          Cookbook Comments:
                                          • Adjust boot time
                                          • Enable AMSI
                                          • Found application associated with file extension: .exe
                                          • Stop behavior analysis, all processes terminated
                                          Warnings:
                                          Show All
                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                          Simulations

                                          Behavior and APIs

                                          TimeTypeDescription
                                          06:08:20API Interceptor1x Sleep call for process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe modified

                                          Joe Sandbox View / Context

                                          IPs

                                          No context

                                          Domains

                                          No context

                                          ASN

                                          No context

                                          JA3 Fingerprints

                                          No context

                                          Dropped Files

                                          No context

                                          Created / dropped Files

                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.log
                                          Process:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          File Type:ASCII text, with CRLF line terminators
                                          Category:dropped
                                          Size (bytes):1314
                                          Entropy (8bit):5.350128552078965
                                          Encrypted:false
                                          SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                          MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                          SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                          SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                          SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                          Malicious:true
                                          Reputation:high, very likely benign file
                                          Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                          Static File Info

                                          General

                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                          Entropy (8bit):7.3164209557831335
                                          TrID:
                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                          • Win32 Executable (generic) a (10002005/4) 49.78%
                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                          • Win16/32 Executable Delphi generic (2074/23) 0.01%
                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                          File name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          File size:982016
                                          MD5:306237cff93b7d61b1f72c400a9522e1
                                          SHA1:aa8942a24452ac6e95feb05f1a5038d006f08c4d
                                          SHA256:4ffd8307eca6e6b382c035cb0ad32e52f37f9180e092764d6224d97557ef8ec9
                                          SHA512:407a56139ff82ba27560dbbd4db76f0a80061f727ca5cb9e12febe25d2a1f246fd6b24ce13b051f975b6a37eb6d24a275d4663abc50df2b47221ae2d8fe4b73d
                                          SSDEEP:12288:HDoTjD7wGGPBVw9hhhxCg7OlOAiSyHesKvOFfYTFEwPAI9S93hwC3yezPcvFXXZH:jIzq2hhhxCHlOA6+s2Ti3hfL2FXXZH
                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g..`..............P..\...........{... ........@.. .......................@............@................................

                                          File Icon

                                          Icon Hash:d4e8e8f8bcacd2cc

                                          Static PE Info

                                          General

                                          Entrypoint:0x4c7b8e
                                          Entrypoint Section:.text
                                          Digitally signed:false
                                          Imagebase:0x400000
                                          Subsystem:windows gui
                                          Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                          DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                          Time Stamp:0x6098C267 [Mon May 10 05:19:35 2021 UTC]
                                          TLS Callbacks:
                                          CLR (.Net) Version:v4.0.30319
                                          OS Version Major:4
                                          OS Version Minor:0
                                          File Version Major:4
                                          File Version Minor:0
                                          Subsystem Version Major:4
                                          Subsystem Version Minor:0
                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                          Entrypoint Preview

                                          Instruction
                                          jmp dword ptr [00402000h]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xc7b400x4b.text
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xc80000x29c00.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xf20000xc.reloc
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          .text0x20000xc5b940xc5c00False0.737166413164data7.60293411131IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                          .rsrc0xc80000x29c000x29c00False0.0827271238772data4.20827824934IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                          .reloc0xf20000xc0x200False0.044921875data0.0980041756627IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                          Resources

                                          NameRVASizeTypeLanguageCountry
                                          RT_ICON0xc82e00x10d2PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                          RT_ICON0xc93b40x10828dBase III DBT, version number 0, next free block index 40
                                          RT_ICON0xd9bdc0x94a8data
                                          RT_ICON0xe30840x5488data
                                          RT_ICON0xe850c0x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 57599, next used block 4278648832
                                          RT_ICON0xec7340x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
                                          RT_ICON0xeecdc0x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
                                          RT_ICON0xefd840x988data
                                          RT_ICON0xf070c0x468GLS_BINARY_LSB_FIRST
                                          RT_GROUP_ICON0xf0b740x84data
                                          RT_GROUP_ICON0xf0bf80x14data
                                          RT_VERSION0xf0c0c0x3b4data
                                          RT_MANIFEST0xf0fc00xc02XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators

                                          Imports

                                          DLLImport
                                          mscoree.dll_CorExeMain

                                          Version Infos

                                          DescriptionData
                                          Translation0x0000 0x04b0
                                          LegalCopyrightCopyright 2015
                                          Assembly Version1.1.755.0
                                          InternalNameMemberFilter.exe
                                          FileVersion1.1.655.0
                                          CompanyName Nsoft Programming
                                          LegalTrademarks Nsoft Programming by Webstar Max
                                          Comments
                                          ProductNameFile Executor
                                          ProductVersion1.1.655.0
                                          FileDescriptionFile Executor
                                          OriginalFilenameMemberFilter.exe

                                          Network Behavior

                                          No network behavior found

                                          Code Manipulations

                                          Statistics

                                          Behavior

                                          Click to jump to process

                                          System Behavior

                                          Analysis Process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 7028 Parent PID: 6128

                                          General

                                          Start time:06:08:10
                                          Start date:12/05/2021
                                          Path:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          Wow64 process (32bit):true
                                          Commandline:'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe'
                                          Imagebase:0x1e0000
                                          File size:982016 bytes
                                          MD5 hash:306237CFF93B7D61B1F72C400A9522E1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:.Net C# or VB.NET
                                          Yara matches:
                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, Author: Joe Security
                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.680894456.00000000035B9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                          • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.680382775.00000000025C3000.00000004.00000001.sdmp, Author: Joe Security
                                          Reputation:low

                                          Analysis Process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 4164 Parent PID: 7028

                                          General

                                          Start time:06:08:21
                                          Start date:12/05/2021
                                          Path:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          Wow64 process (32bit):true
                                          Commandline:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                                          Imagebase:0x620000
                                          File size:982016 bytes
                                          MD5 hash:306237CFF93B7D61B1F72C400A9522E1
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Yara matches:
                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.680778929.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                          Reputation:low

                                          Disassembly

                                          Code Analysis

                                          Reset < >