Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe

Overview

General Information

Sample Name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
Analysis ID:412016
MD5:33d849675e66bf8332b4bb2e4a1d923f
SHA1:5a6a124d73391b021ffb15b5fe0bef53882e9d9b
SHA256:77a065555ec0a5c4dfbae72cdb035af45edf7997b1859fa75a158c40f119a020
Tags:exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Uses an obfuscated file name to hide its real file extension (double extension)
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x166b9:$sqlite3step: 68 34 1C 7B E1
    • 0x167cc:$sqlite3step: 68 34 1C 7B E1
    • 0x166e8:$sqlite3text: 68 38 2A 90 C5
    • 0x1680d:$sqlite3text: 68 38 2A 90 C5
    • 0x166fb:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16823:$sqlite3blob: 68 53 D8 7F 8C
    00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
      00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x18987:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x19a2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x158b9:$sqlite3step: 68 34 1C 7B E1
          • 0x159cc:$sqlite3step: 68 34 1C 7B E1
          • 0x158e8:$sqlite3text: 68 38 2A 90 C5
          • 0x15a0d:$sqlite3text: 68 38 2A 90 C5
          • 0x158fb:$sqlite3blob: 68 53 D8 7F 8C
          • 0x15a23:$sqlite3blob: 68 53 D8 7F 8C
          3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x19787:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1a82a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            Click to see the 1 entries

            Sigma Overview

            System Summary:

            barindex
            Sigma detected: Suspicious Double ExtensionShow sources
            Source: Process startedAuthor: Florian Roth (rule), @blu3_team (idea): Data: Command: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, CommandLine: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, NewProcessName: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, OriginalFileName: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ParentCommandLine: 'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe' , ParentImage: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ParentProcessId: 6764, ProcessCommandLine: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, ProcessId: 6892

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.rogegalmish.com/a8si/"], "decoy": ["mosquitocontrolpro.com", "omfgphil.com", "qqkit.net", "compusolutionsac.com", "skynetaccess.com", "helmetmoto.com", "webdomoupravitel.com", "thepocket-onlinelesson.xyz", "stefaniehirsch.space", "goalsandballs.com", "xn--bro-ba-3ya.com", "tomrings.com", "4520oceanviewavenue.com", "mamaebemorientada.com", "shopwreathrails.com", "restaurantestancia.com", "annaquatics.info", "mnarchitect.design", "best-cleaner.com", "jobhuizhan.com", "check-info-bank.network", "boostcoachingonline.com", "basimogroup.com", "076fb5.com", "conansr.icu", "numbereightturquoise.com", "southernbrushworks.com", "home-inland.com", "irrpa.com", "ethereumdailypay.com", "betsysellsswfl.com", "cutebyconstance.website", "modelsnt.com", "medifilt.com", "tracisolomon.xyz", "dchaulingdisposal.com", "minchenhy.com", "smart4earth.com", "rackembilliards.com", "benschiller-coaching.com", "virtualroasters.com", "applewholesales.com", "thesidspot.com", "grechenblogs.com", "marshlandlogisticsservices.net", "covidokotoks.com", "mirabilla.com", "hunab.tech", "foreverjsdesigns.com", "heipacc.info", "simon-schilling.com", "shirleyeluiz.com", "juguetibicicollectors.com", "70shousemanchester.com", "tranthaolinh.net", "urbanpokebar.com", "madras-spice.com", "fulmardelta.net", "drisu-goalkeeping.com", "jiotest.com", "vitatiensa.com", "melbournebusinesslawyers.net", "rajehomes.com", "company-for-you.com"]}
            Multi AV Scanner detection for submitted fileShow sources
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeVirustotal: Detection: 58%Perma Link
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeReversingLabs: Detection: 68%
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Machine Learning detection for sampleShow sources
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeJoe Sandbox ML: detected
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000003.00000002.339176685.0000000001300000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 4x nop then pop ebx

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: www.rogegalmish.com/a8si/
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338326905.0000000002DB1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

            E-Banking Fraud:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Initial sample is a PE file and has a suspicious nameShow sources
            Source: initial sampleStatic PE information: Filename: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004181C0 NtCreateFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00418270 NtReadFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004182F0 NtClose,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004183A0 NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041826A NtReadFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041839A NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369660 NtAllocateVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013696E0 NtFreeVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369910 NtAdjustPrivilegesToken,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369950 NtQueueApcThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013699A0 NtCreateSection,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013699D0 NtCreateProcessEx,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369820 NtEnumerateKey,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136B040 NtSuspendThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369840 NtDelayExecution,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013698A0 NtWriteVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013698F0 NtReadVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369B00 NtSetValueKey,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136A3B0 NtGetContextThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369A20 NtResumeThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369A10 NtQuerySection,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369A00 NtProtectVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369A50 NtCreateFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369A80 NtOpenDirectoryObject,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136AD30 NtSetContextThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369520 NtWaitForSingleObject,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369560 NtWriteFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369540 NtReadFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013695F0 NtQueryInformationFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013695D0 NtClose,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369730 NtQueryVirtualMemory,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369710 NtQueryInformationToken,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136A710 NtOpenProcessToken,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136A770 NtOpenThread,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369770 NtSetInformationFile,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369760 NtOpenProcess,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013697A0 NtUnmapViewOfSection,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369780 NtMapViewOfSection,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369FE0 NtCreateMutant,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369610 NtEnumerateValueKey,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369670 NtQueryInformationProcess,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369650 NtQueryValueKey,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_02C4C2B0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_02C49968
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B778221
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B770FA8
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B770040
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B770033
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B7717E8
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B7717D9
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B770F98
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B773660
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B771E40
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B771E39
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B775690
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B775680
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B7714E0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B7714CF
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00401030
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041C273
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041BAA2
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00408C5B
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00408C60
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041BC22
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041CC24
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041B4A6
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041BD4F
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041C501
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00402D87
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00402D90
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041BDBD
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041BF3C
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041C7A5
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00402FB0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132F900
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01342990
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133C1C0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A830
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013FE824
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01326800
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1002
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F20A8
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B090
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E60F5
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F28EC
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F2B28
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E231B
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01343360
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CCB4F
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134AB40
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135EBB0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134EB9A
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CEB8A
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135138B
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D23E3
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01378BE8
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E03DA
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EDBD2
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135ABD8
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013DFA2B
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E5A4F
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F22AE
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F32A9
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EE2C5
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01320D20
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F2D07
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01342D50
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F1D55
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013565A0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352581
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133D5E0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F25DD
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01342430
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133841F
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013ED466
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4496
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354CD4
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F1FF1
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E67E2
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013FDFCE
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01346E30
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013ED616
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01345600
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013AAE60
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 0132B150 appears 159 times
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 0137D08C appears 46 times
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: String function: 013B5720 appears 81 times
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.337682836.0000000000B2A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAsyncReplySink.exe0 vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.342343612.0000000006220000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll@ vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338326905.0000000002DB1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll( vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000002.00000000.335604595.000000000038A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAsyncReplySink.exe0 vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000003.00000002.338967434.000000000091A000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAsyncReplySink.exe0 vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000003.00000002.339718035.00000000015AF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeBinary or memory string: OriginalFilenameAsyncReplySink.exe0 vs T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: classification engineClassification label: mal100.troj.evad.winEXE@5/1@0/0
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.logJump to behavior
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE id=@id;
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeVirustotal: Detection: 58%
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeReversingLabs: Detection: 68%
            Source: unknownProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe 'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe'
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000003.00000002.339176685.0000000001300000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 0_2_0B7705DC push ebx; iretd
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004161E7 push edi; retf
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004151B4 pushfd ; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041B3B5 push eax; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041B46C push eax; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041B402 push eax; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041B40B push eax; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0041543B pushfd ; iretd
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_00415485 push edx; ret
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0137D0D1 push ecx; ret
            Source: initial sampleStatic PE information: section name: .text entropy: 7.68296959496

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Uses an obfuscated file name to hide its real file extension (double extension)Show sources
            Source: Possible double extension: pdf.exeStatic PE information: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion:

            barindex
            Yara detected AntiVM3Show sources
            Source: Yara matchFile source: 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 6764, type: MEMORY
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeRDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeRDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004088B0 rdtsc
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 6768Thread sleep time: -100297s >= -30000s
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe TID: 6788Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 100297
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeThread delayed: delay time: 922337203685477
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: vmware
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: VMWARE
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
            Source: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess queried: DebugPort
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_004088B0 rdtsc
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01369860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01323138 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01344120 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01330100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01330100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01330100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132B171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132C962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8966 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EE962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1951 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A51BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135C9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135C9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013FF1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013FF1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013499BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013361A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013361A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013361A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013361A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013561A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013561A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E49A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E49A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E49A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E49A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A69A6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352990 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354190 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132519E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132519E mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135A185 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134C182 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EA189 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EA189 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013231E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013B41E8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132B1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F89E7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E19D8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133C1C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013399C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013399C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013399C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013399C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354020 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135701D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F4015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F4015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A7016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01326800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01326800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01326800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F1074 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2073 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134F86D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01340050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01340050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01327057 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1843 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F0BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013520A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013578A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013690AF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329080 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01323880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01323880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A3884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E60F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E60F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E60F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E60F5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013328FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013240E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013240E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013240E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013258EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013278D6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013278D6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013278D6 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013270C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013270C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E18CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E131B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133F370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132DB60 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013B6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013B6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013B6365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8B58 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132F358 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132DB40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F9BBE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8BB6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1BA8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F5BA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352397 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135B390 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01324B94 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134EB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134EB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E138A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CEB8A mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CEB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01331B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01331B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013DD380 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013503E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01321BE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134DBE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D23E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D23E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D23E3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A53CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A53CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013553C5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01328239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01328239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01328239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01324A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01324A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01364A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01364A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134A229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325210 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01343A1C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EAA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EAA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133BA00 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01338A0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0136927A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013DB260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013DB260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8A62 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01365A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01365A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01365A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1A5F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EEA55 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013B4257 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E5A4F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E5A4F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E5A4F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E5A4F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01329240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133AAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135FAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013512BD mov esi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013512BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013512BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01321AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01355AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01355AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013252A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013252A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013252A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013252A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013252A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135D294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E129A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135DA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135DA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352AE4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E4AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8ADD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013212D4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01325AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01323ACA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352ACB mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132AD30 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01333D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EE539 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8D34 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013AA537 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01354D3B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135F527 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E3518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E3518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E3518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132751A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132751A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132751A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132751A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013CCD04 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01348D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01348D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01348D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01348D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01348D76 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134C577 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01347D50 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01364D51 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01364D51 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01363D43 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A3540 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D8D47 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D3D40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132354C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0132354C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01351DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01351DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01351DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F05AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F05AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013535A1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013565A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013565A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013565A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01323591 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135FD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01352581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01322D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01322D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01322D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01322D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01322D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E2D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EB581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EB581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EB581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EB581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013295F0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013295F0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013D8DF1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133D5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013595EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EFDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EFDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EFDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013EFDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013DFDD3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013215C1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0133B433 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01342430 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01342430 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01353C3E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01324439 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135BC2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8C14 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013A6C0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F740D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013E1C06 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0134B477 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_01365C70 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_013F8C75 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeCode function: 3_2_0135AC7B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Injects a PE file into a foreign processesShow sources
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeMemory written: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe base: 400000 value starts with: 4D5A
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeProcess created: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
            Source: C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Stealing of Sensitive Information:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

            Remote Access Functionality:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.raw.unpack, type: UNPACKEDPE

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading11OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information14Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe59%VirustotalBrowse
            T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe12%MetadefenderBrowse
            T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe69%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
            T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe100%Joe Sandbox ML

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            3.2.T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            www.rogegalmish.com/a8si/3%VirustotalBrowse
            www.rogegalmish.com/a8si/0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.rogegalmish.com/a8si/true
            • 3%, Virustotal, Browse
            • Avira URL Cloud: safe
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338326905.0000000002DB1000.00000004.00000001.sdmpfalse
              		high
              https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssT31597760-Confirm-20210507-100016-Email-1574401.PDF.exe, 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmpfalse
                		high

                Contacted IPs

                No contacted IP infos

                General Information

                Joe Sandbox Version:32.0.0 Black Diamond
                Analysis ID:412016
                Start date:12.05.2021
                Start time:10:41:28
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 6m 49s
                Hypervisor based Inspection enabled:false
                Report type:light
                Sample file name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                Number of analysed new started processes analysed:4
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal100.troj.evad.winEXE@5/1@0/0
                EGA Information:Failed
                HDC Information:
                • Successful, ratio: 1.6% (good quality ratio 1.5%)
                • Quality average: 67.5%
                • Quality standard deviation: 29.9%
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 0
                • Number of non-executed functions: 0
                Cookbook Comments:
                • Adjust boot time
                • Enable AMSI
                • Found application associated with file extension: .exe
                • Stop behavior analysis, all processes terminated

                Simulations

                Behavior and APIs

                TimeTypeDescription
                10:42:20API Interceptor1x Sleep call for process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe modified

                Joe Sandbox View / Context

                IPs

                No context

                Domains

                No context

                ASN

                No context

                JA3 Fingerprints

                No context

                Dropped Files

                No context

                Created / dropped Files

                C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe.log
                Process:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):1314
                Entropy (8bit):5.350128552078965
                Encrypted:false
                SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                Malicious:true
                Reputation:high, very likely benign file
                Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                Static File Info

                General

                File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                Entropy (8bit):7.334342506830447
                TrID:
                • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                • Win32 Executable (generic) a (10002005/4) 49.78%
                • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                • Generic Win/DOS Executable (2004/3) 0.01%
                • DOS Executable Generic (2002/1) 0.01%
                File name:T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                File size:843264
                MD5:33d849675e66bf8332b4bb2e4a1d923f
                SHA1:5a6a124d73391b021ffb15b5fe0bef53882e9d9b
                SHA256:77a065555ec0a5c4dfbae72cdb035af45edf7997b1859fa75a158c40f119a020
                SHA512:1567d7b75a49cfc4dea92b703310395898ea6e4e7b6b5716f046ae0c9aefc96cb2f09c0fda1cfc2e827d1ef62decd6735e82a93dc84a39ed04c0e14f84f292f2
                SSDEEP:12288:Z70hHwq6oGbWgW4nVV2aiGnCqlAkS6cGfRxyFkpHbsM:h0hQDoG66nVOjab7s
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...HR.`..............P..H...........g... ........@.. .......................@............@................................

                File Icon

                Icon Hash:d4e8e8f8bcacd2cc

                Static PE Info

                General

                Entrypoint:0x4a67f2
                Entrypoint Section:.text
                Digitally signed:false
                Imagebase:0x400000
                Subsystem:windows gui
                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                Time Stamp:0x60985248 [Sun May 9 21:21:12 2021 UTC]
                TLS Callbacks:
                CLR (.Net) Version:v4.0.30319
                OS Version Major:4
                OS Version Minor:0
                File Version Major:4
                File Version Minor:0
                Subsystem Version Major:4
                Subsystem Version Minor:0
                Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                Entrypoint Preview

                Instruction
                jmp dword ptr [00402000h]
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IMPORT0xa67a00x4f.text
                IMAGE_DIRECTORY_ENTRY_RESOURCE0xa80000x29130.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0xd20000xc.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x20000xa47f80xa4800False0.824677348499data7.68296959496IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                .rsrc0xa80000x291300x29200False0.0776856952888data4.11408600816IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0xd20000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Resources

                NameRVASizeTypeLanguageCountry
                RT_ICON0xa82e00x10d2PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                RT_ICON0xa93b40x10828dBase III DBT, version number 0, next free block index 40
                RT_ICON0xb9bdc0x94a8data
                RT_ICON0xc30840x5488data
                RT_ICON0xc850c0x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 57599, next used block 4278648832
                RT_ICON0xcc7340x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
                RT_ICON0xcecdc0x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
                RT_ICON0xcfd840x988data
                RT_ICON0xd070c0x468GLS_BINARY_LSB_FIRST
                RT_GROUP_ICON0xd0b740x84data
                RT_GROUP_ICON0xd0bf80x14data
                RT_VERSION0xd0c0c0x338data
                RT_MANIFEST0xd0f440x1eaXML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

                Imports

                DLLImport
                mscoree.dll_CorExeMain

                Version Infos

                DescriptionData
                Translation0x0000 0x04b0
                LegalCopyrightCopyright MCS 2018
                Assembly Version1.0.0.0
                InternalNameAsyncReplySink.exe
                FileVersion1.0.0.0
                CompanyNameMCS
                LegalTrademarks
                Comments
                ProductNameLibrary
                ProductVersion1.0.0.0
                FileDescriptionLibrary
                OriginalFilenameAsyncReplySink.exe

                Network Behavior

                No network behavior found

                Code Manipulations

                Statistics

                Behavior

                Click to jump to process

                System Behavior

                Analysis Process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 6764 Parent PID: 5952

                General

                Start time:10:42:17
                Start date:12/05/2021
                Path:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Wow64 process (32bit):true
                Commandline:'C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe'
                Imagebase:0xa70000
                File size:843264 bytes
                MD5 hash:33D849675E66BF8332B4BB2E4A1D923F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:.Net C# or VB.NET
                Yara matches:
                • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.338400909.0000000002E06000.00000004.00000001.sdmp, Author: Joe Security
                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, Author: Joe Security
                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.338738770.0000000003DB9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                Reputation:low

                Analysis Process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 6892 Parent PID: 6764

                General

                Start time:10:42:22
                Start date:12/05/2021
                Path:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Wow64 process (32bit):false
                Commandline:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Imagebase:0x2d0000
                File size:843264 bytes
                MD5 hash:33D849675E66BF8332B4BB2E4A1D923F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:low

                Analysis Process: T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe PID: 6900 Parent PID: 6764

                General

                Start time:10:42:22
                Start date:12/05/2021
                Path:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Wow64 process (32bit):true
                Commandline:C:\Users\user\Desktop\T31597760-Confirm-20210507-100016-Email-1574401.PDF.exe
                Imagebase:0x860000
                File size:843264 bytes
                MD5 hash:33D849675E66BF8332B4BB2E4A1D923F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                • Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.338833757.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                Reputation:low

                Disassembly

                Code Analysis

                Reset < >