Analysis Report DHL_document11022020680908006.exe

Overview

General Information

Sample Name: DHL_document11022020680908006.exe
Analysis ID: 385270
MD5: 68d63479e5a11048e6bc1eaa242f8c7b
SHA1: 8637b7ec04a9ff11b8fc6d99a51f911aaad5a889
SHA256: 0bc287a98874b2ba0b818013c4026180a2e210a65d0800a169dde7ad7725277b
Tags: CHNDHLexeFormbookgeo
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.bendhighswimming.com/crdi/"], "decoy": ["propertyjumpstartwebinar.com", "boc-vip.club", "polestarnyc.com", "travelonlinebiz.com", "bukovynaent.com", "bestfashoin.com", "miniindiastore.com", "wehatebillgates.com", "holmescountyjusticecourt.com", "colectivorenovemosjuntos.com", "houstowarehouse.com", "aocsw.com", "sml-uniform.com", "bandanasaint.com", "petposhdeluxe.com", "ezcscpawq.com", "ladiesoption.club", "refixu.com", "selfwrrrth.com", "rovietry.com", "enaoc.com", "karyolaw.com", "diversitymarketingtx.net", "browsersentenderbanco.net", "samtheshepherd.com", "nash-arbitrazh.com", "gampang-kerja.tech", "ereplacementparrts.com", "eventmidasbuy14.com", "sia-rikvel.com", "top2016.net", "686638.com", "ton.blue", "desktower.net", "dbykq020.com", "stack30.com", "tiendasfotoprix.com", "kylesmaier.com", "ekmantsang.com", "jumlasx.xyz", "qingqingyuyin.com", "cdnsubs.xyz", "maxamoose.com", "huelling.com", "xn--bjrnnstet-z2a8q.online", "betale-posten.com", "lalatendu.info", "nochipmanicure.net", "bichat.website", "washington32reds.com", "centrodesaludcrecer.com", "phihoteldeimedaglioni.com", "kilmalliefarms.com", "icecreamsocialwp.com", "mac-makeup.club", "elzooz.com", "iqomw.com", "bestattorneycle.com", "startonsocial.com", "purensoessentials.com", "therealyolandafay.com", "feildwolf.com", "nativesupps.com", "nbatimeout.com"]}
Multi AV Scanner detection for submitted file
Source: DHL_document11022020680908006.exe ReversingLabs: Detection: 25%
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: DHL_document11022020680908006.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: DHL_document11022020680908006.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: DHL_document11022020680908006.exe, 00000006.00000002.259975111.0000000001880000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: DHL_document11022020680908006.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_011B78E8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_011B789F

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.bendhighswimming.com/crdi/
Source: DHL_document11022020680908006.exe, 00000000.00000003.233610834.000000000120D000.00000004.00000001.sdmp String found in binary or memory: http://en.wQ
Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL_document11022020680908006.exe, 00000000.00000003.236661880.0000000005B70000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com?
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL_document11022020680908006.exe, 00000000.00000003.240077453.0000000005B69000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers-
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL_document11022020680908006.exe, 00000000.00000003.240581343.0000000005B6D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersY
Source: DHL_document11022020680908006.exe, 00000000.00000002.270290969.0000000005B60000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: DHL_document11022020680908006.exe, 00000000.00000003.234336459.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.comn
Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn-
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnl-g&
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ana
Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/iva
Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/_
Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000003.233917646.0000000005B81000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com5
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: DHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: DHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krntact
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comU
Source: DHL_document11022020680908006.exe, 00000000.00000003.234707922.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comh
Source: DHL_document11022020680908006.exe, 00000000.00000003.234663283.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.coml
Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.comnh
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: DHL_document11022020680908006.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041A060 NtClose, 6_2_0041A060
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041A110 NtAllocateVirtualMemory, 6_2_0041A110
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00419F30 NtCreateFile, 6_2_00419F30
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00419FE0 NtReadFile, 6_2_00419FE0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041A05A NtClose, 6_2_0041A05A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041A10C NtAllocateVirtualMemory, 6_2_0041A10C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00419FDA NtReadFile, 6_2_00419FDA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9860 NtQuerySystemInformation,LdrInitializeThunk, 6_2_018E9860
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E96E0 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_018E96E0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9660 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_018E9660
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E99A0 NtCreateSection, 6_2_018E99A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E99D0 NtCreateProcessEx, 6_2_018E99D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9910 NtAdjustPrivilegesToken, 6_2_018E9910
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9950 NtQueueApcThread, 6_2_018E9950
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E98A0 NtWriteVirtualMemory, 6_2_018E98A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E98F0 NtReadVirtualMemory, 6_2_018E98F0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9820 NtEnumerateKey, 6_2_018E9820
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018EB040 NtSuspendThread, 6_2_018EB040
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9840 NtDelayExecution, 6_2_018E9840
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018EA3B0 NtGetContextThread, 6_2_018EA3B0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9B00 NtSetValueKey, 6_2_018E9B00
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9A80 NtOpenDirectoryObject, 6_2_018E9A80
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9A00 NtProtectVirtualMemory, 6_2_018E9A00
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9A10 NtQuerySection, 6_2_018E9A10
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9A20 NtResumeThread, 6_2_018E9A20
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9A50 NtCreateFile, 6_2_018E9A50
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E95D0 NtClose, 6_2_018E95D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E95F0 NtQueryInformationFile, 6_2_018E95F0
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_00714D16 0_2_00714D16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_0071869D 0_2_0071869D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B8168 0_2_011B8168
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B0960 0_2_011B0960
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B13B0 0_2_011B13B0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B1A6B 0_2_011B1A6B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B55FC 0_2_011B55FC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B6CC8 0_2_011B6CC8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B0915 0_2_011B0915
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B5038 0_2_011B5038
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B4DF0 0_2_011B4DF0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B55F0 0_2_011B55F0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B540F 0_2_011B540F
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B6CBF 0_2_011B6CBF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B2E08 0_2_011B2E08
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B5638 0_2_011B5638
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B5647 0_2_011B5647
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B6EE9 0_2_011B6EE9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_02ABC428 0_2_02ABC428
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_02AB9890 0_2_02AB9890
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_002F4D16 3_2_002F4D16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_002F869D 3_2_002F869D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_00254D16 4_2_00254D16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_0025869D 4_2_0025869D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00401029 6_2_00401029
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00401030 6_2_00401030
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D173 6_2_0041D173
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041E3E6 6_2_0041E3E6
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041DBBB 6_2_0041DBBB
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00402D87 6_2_00402D87
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D589 6_2_0041D589
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00402D90 6_2_00402D90
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00409E40 6_2_00409E40
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00409E3B 6_2_00409E3B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041DFAA 6_2_0041DFAA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00402FB0 6_2_00402FB0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00DE4D16 6_2_00DE4D16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00DE869D 6_2_00DE869D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C2990 6_2_018C2990
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AF900 6_2_018AF900
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BB090 6_2_018BB090
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019720A8 6_2_019720A8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019728EC 6_2_019728EC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A6800 6_2_018A6800
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961002 6_2_01961002
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0197E824 6_2_0197E824
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA830 6_2_018CA830
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D138B 6_2_018D138B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CEB9A 6_2_018CEB9A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194EB8A 6_2_0194EB8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DEBB0 6_2_018DEBB0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196DBD2 6_2_0196DBD2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019603DA 6_2_019603DA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DABD8 6_2_018DABD8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018F8BE8 6_2_018F8BE8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019523E3 6_2_019523E3
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196231B 6_2_0196231B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01972B28 6_2_01972B28
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CAB40 6_2_018CAB40
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194CB4F 6_2_0194CB4F
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C3360 6_2_018C3360
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019722AE 6_2_019722AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019732A9 6_2_019732A9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196E2C5 6_2_0196E2C5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0195FA2B 6_2_0195FA2B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2581 6_2_018D2581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D65A0 6_2_018D65A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019725DD 6_2_019725DD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BD5E0 6_2_018BD5E0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01972D07 6_2_01972D07
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: String function: 018AB150 appears 88 times
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: String function: 01935720 appears 47 times
Sample file is different than original file name gathered from version info
Source: DHL_document11022020680908006.exe, 00000000.00000002.272033610.00000000077C0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll2 vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000000.00000000.231107081.00000000007C6000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000000.00000002.271515431.0000000007150000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll" vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000003.00000002.255099385.00000000003A6000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000004.00000000.255948475.0000000000306000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000006.00000002.259562052.0000000000E96000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe, 00000006.00000002.260362622.0000000001B2F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_document11022020680908006.exe
Source: DHL_document11022020680908006.exe Binary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
Uses 32bit PE files
Source: DHL_document11022020680908006.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: DHL_document11022020680908006.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@0/0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_document11022020680908006.exe.log Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Mutant created: \Sessions\1\BaseNamedObjects\NIuDJQPdpTkCF
Source: DHL_document11022020680908006.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: DHL_document11022020680908006.exe ReversingLabs: Detection: 25%
Source: unknown Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe 'C:\Users\user\Desktop\DHL_document11022020680908006.exe'
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: DHL_document11022020680908006.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL_document11022020680908006.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: DHL_document11022020680908006.exe, 00000006.00000002.259975111.0000000001880000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: DHL_document11022020680908006.exe

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_007BB088 push eax; ret 0_2_007BB08C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_007BA258 push edi; iretd 0_2_007BA259
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_007B8F6B push FFFFFFFEh; retf 0_2_007B8F6D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_007B8B14 pushfd ; iretd 0_2_007B8B17
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_007BA30F push ebx; retf 0_2_007BA310
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 0_2_011B4590 push FFFFFFA0h; iretd 0_2_011B4597
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_0039B088 push eax; ret 3_2_0039B08C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_0039A258 push edi; iretd 3_2_0039A259
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_00398B14 pushfd ; iretd 3_2_00398B17
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_0039A30F push ebx; retf 3_2_0039A310
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 3_2_00398F6B push FFFFFFFEh; retf 3_2_00398F6D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_002FB088 push eax; ret 4_2_002FB08C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_002FA258 push edi; iretd 4_2_002FA259
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_002FA30F push ebx; retf 4_2_002FA310
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_002F8B14 pushfd ; iretd 4_2_002F8B17
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 4_2_002F8F6B push FFFFFFFEh; retf 4_2_002F8F6D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041C875 push ss; retf 6_2_0041C87C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041C811 push ss; retf 6_2_0041C87C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D0D2 push eax; ret 6_2_0041D0D8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D0DB push eax; ret 6_2_0041D142
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D085 push eax; ret 6_2_0041D0D8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041D13C push eax; ret 6_2_0041D142
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0041A1C6 pushfd ; iretd 6_2_0041A1CB
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00419AC6 push edx; ret 6_2_00419ACA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00407B28 push FFFFFFC4h; ret 6_2_00407B2A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00416B8B push cs; iretd 6_2_00416B93
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00E8B088 push eax; ret 6_2_00E8B08C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00E8A258 push edi; iretd 6_2_00E8A259
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00E8A30F push ebx; retf 6_2_00E8A310
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00E88B14 pushfd ; iretd 6_2_00E88B17
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00E88F6B push FFFFFFFEh; retf 6_2_00E88F6D
Source: initial sample Static PE information: section name: .text entropy: 7.95739583157
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL_document11022020680908006.exe PID: 240, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00409A90 rdtsc 6_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 5292 Thread sleep time: -103301s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 5288 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 2248 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Thread delayed: delay time: 103301 Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_00409A90 rdtsc 6_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E9860 NtQuerySystemInformation,LdrInitializeThunk, 6_2_018E9860
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DA185 mov eax, dword ptr fs:[00000030h] 6_2_018DA185
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CC182 mov eax, dword ptr fs:[00000030h] 6_2_018CC182
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A519E mov eax, dword ptr fs:[00000030h] 6_2_018A519E
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A519E mov ecx, dword ptr fs:[00000030h] 6_2_018A519E
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2990 mov eax, dword ptr fs:[00000030h] 6_2_018D2990
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D4190 mov eax, dword ptr fs:[00000030h] 6_2_018D4190
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196A189 mov eax, dword ptr fs:[00000030h] 6_2_0196A189
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196A189 mov ecx, dword ptr fs:[00000030h] 6_2_0196A189
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0197F1B5 mov eax, dword ptr fs:[00000030h] 6_2_0197F1B5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0197F1B5 mov eax, dword ptr fs:[00000030h] 6_2_0197F1B5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019251BE mov eax, dword ptr fs:[00000030h] 6_2_019251BE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019251BE mov eax, dword ptr fs:[00000030h] 6_2_019251BE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019251BE mov eax, dword ptr fs:[00000030h] 6_2_019251BE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019251BE mov eax, dword ptr fs:[00000030h] 6_2_019251BE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h] 6_2_018B61A7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h] 6_2_018B61A7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h] 6_2_018B61A7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h] 6_2_018B61A7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D61A0 mov eax, dword ptr fs:[00000030h] 6_2_018D61A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D61A0 mov eax, dword ptr fs:[00000030h] 6_2_018D61A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h] 6_2_019649A4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h] 6_2_019649A4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h] 6_2_019649A4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h] 6_2_019649A4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DC9BF mov eax, dword ptr fs:[00000030h] 6_2_018DC9BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DC9BF mov eax, dword ptr fs:[00000030h] 6_2_018DC9BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h] 6_2_018C99BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019269A6 mov eax, dword ptr fs:[00000030h] 6_2_019269A6
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h] 6_2_018B99C7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h] 6_2_018B99C7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h] 6_2_018B99C7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h] 6_2_018B99C7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019619D8 mov eax, dword ptr fs:[00000030h] 6_2_019619D8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A31E0 mov eax, dword ptr fs:[00000030h] 6_2_018A31E0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h] 6_2_018AB1E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h] 6_2_018AB1E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h] 6_2_018AB1E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019789E7 mov eax, dword ptr fs:[00000030h] 6_2_019789E7
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019341E8 mov eax, dword ptr fs:[00000030h] 6_2_019341E8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h] 6_2_018A9100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h] 6_2_018A9100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h] 6_2_018A9100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h] 6_2_018B0100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h] 6_2_018B0100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h] 6_2_018B0100
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h] 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h] 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h] 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h] 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C4120 mov ecx, dword ptr fs:[00000030h] 6_2_018C4120
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A3138 mov ecx, dword ptr fs:[00000030h] 6_2_018A3138
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D513A mov eax, dword ptr fs:[00000030h] 6_2_018D513A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D513A mov eax, dword ptr fs:[00000030h] 6_2_018D513A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961951 mov eax, dword ptr fs:[00000030h] 6_2_01961951
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB944 mov eax, dword ptr fs:[00000030h] 6_2_018CB944
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB944 mov eax, dword ptr fs:[00000030h] 6_2_018CB944
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A395E mov eax, dword ptr fs:[00000030h] 6_2_018A395E
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A395E mov eax, dword ptr fs:[00000030h] 6_2_018A395E
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AC962 mov eax, dword ptr fs:[00000030h] 6_2_018AC962
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01978966 mov eax, dword ptr fs:[00000030h] 6_2_01978966
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196E962 mov eax, dword ptr fs:[00000030h] 6_2_0196E962
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AB171 mov eax, dword ptr fs:[00000030h] 6_2_018AB171
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AB171 mov eax, dword ptr fs:[00000030h] 6_2_018AB171
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9080 mov eax, dword ptr fs:[00000030h] 6_2_018A9080
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A3880 mov eax, dword ptr fs:[00000030h] 6_2_018A3880
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A3880 mov eax, dword ptr fs:[00000030h] 6_2_018A3880
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01923884 mov eax, dword ptr fs:[00000030h] 6_2_01923884
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01923884 mov eax, dword ptr fs:[00000030h] 6_2_01923884
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E90AF mov eax, dword ptr fs:[00000030h] 6_2_018E90AF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov ecx, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h] 6_2_018B28AE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h] 6_2_018D20A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h] 6_2_018D78A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DF0BF mov ecx, dword ptr fs:[00000030h] 6_2_018DF0BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DF0BF mov eax, dword ptr fs:[00000030h] 6_2_018DF0BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DF0BF mov eax, dword ptr fs:[00000030h] 6_2_018DF0BF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov ecx, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h] 6_2_0193B8D0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A70C0 mov eax, dword ptr fs:[00000030h] 6_2_018A70C0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A70C0 mov eax, dword ptr fs:[00000030h] 6_2_018A70C0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019618CA mov eax, dword ptr fs:[00000030h] 6_2_019618CA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A58EC mov eax, dword ptr fs:[00000030h] 6_2_018A58EC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB8E4 mov eax, dword ptr fs:[00000030h] 6_2_018CB8E4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB8E4 mov eax, dword ptr fs:[00000030h] 6_2_018CB8E4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h] 6_2_018A40E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h] 6_2_018A40E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h] 6_2_018A40E1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h] 6_2_018B28FD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h] 6_2_018B28FD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h] 6_2_018B28FD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01974015 mov eax, dword ptr fs:[00000030h] 6_2_01974015
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01974015 mov eax, dword ptr fs:[00000030h] 6_2_01974015
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01927016 mov eax, dword ptr fs:[00000030h] 6_2_01927016
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01927016 mov eax, dword ptr fs:[00000030h] 6_2_01927016
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01927016 mov eax, dword ptr fs:[00000030h] 6_2_01927016
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h] 6_2_018A6800
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h] 6_2_018A6800
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h] 6_2_018A6800
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D002D mov eax, dword ptr fs:[00000030h] 6_2_018D002D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D002D mov eax, dword ptr fs:[00000030h] 6_2_018D002D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D002D mov eax, dword ptr fs:[00000030h] 6_2_018D002D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D002D mov eax, dword ptr fs:[00000030h] 6_2_018D002D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D002D mov eax, dword ptr fs:[00000030h] 6_2_018D002D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h] 6_2_018BB02A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h] 6_2_018BB02A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h] 6_2_018BB02A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h] 6_2_018BB02A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D4020 mov edi, dword ptr fs:[00000030h] 6_2_018D4020
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h] 6_2_018CA830
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h] 6_2_018CA830
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h] 6_2_018CA830
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h] 6_2_018CA830
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961843 mov eax, dword ptr fs:[00000030h] 6_2_01961843
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h] 6_2_018A5050
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h] 6_2_018A5050
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h] 6_2_018A5050
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C0050 mov eax, dword ptr fs:[00000030h] 6_2_018C0050
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C0050 mov eax, dword ptr fs:[00000030h] 6_2_018C0050
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A7057 mov eax, dword ptr fs:[00000030h] 6_2_018A7057
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CF86D mov eax, dword ptr fs:[00000030h] 6_2_018CF86D
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01971074 mov eax, dword ptr fs:[00000030h] 6_2_01971074
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962073 mov eax, dword ptr fs:[00000030h] 6_2_01962073
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B1B8F mov eax, dword ptr fs:[00000030h] 6_2_018B1B8F
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B1B8F mov eax, dword ptr fs:[00000030h] 6_2_018B1B8F
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D138B mov eax, dword ptr fs:[00000030h] 6_2_018D138B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D138B mov eax, dword ptr fs:[00000030h] 6_2_018D138B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D138B mov eax, dword ptr fs:[00000030h] 6_2_018D138B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0195D380 mov ecx, dword ptr fs:[00000030h] 6_2_0195D380
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CEB9A mov eax, dword ptr fs:[00000030h] 6_2_018CEB9A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CEB9A mov eax, dword ptr fs:[00000030h] 6_2_018CEB9A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2397 mov eax, dword ptr fs:[00000030h] 6_2_018D2397
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196138A mov eax, dword ptr fs:[00000030h] 6_2_0196138A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DB390 mov eax, dword ptr fs:[00000030h] 6_2_018DB390
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194EB8A mov ecx, dword ptr fs:[00000030h] 6_2_0194EB8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h] 6_2_0194EB8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h] 6_2_0194EB8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h] 6_2_0194EB8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A4B94 mov edi, dword ptr fs:[00000030h] 6_2_018A4B94
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h] 6_2_018D4BAD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h] 6_2_018D4BAD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h] 6_2_018D4BAD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01978BB6 mov eax, dword ptr fs:[00000030h] 6_2_01978BB6
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01979BBE mov eax, dword ptr fs:[00000030h] 6_2_01979BBE
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01975BA5 mov eax, dword ptr fs:[00000030h] 6_2_01975BA5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961BA8 mov eax, dword ptr fs:[00000030h] 6_2_01961BA8
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D53C5 mov eax, dword ptr fs:[00000030h] 6_2_018D53C5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019253CA mov eax, dword ptr fs:[00000030h] 6_2_019253CA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019253CA mov eax, dword ptr fs:[00000030h] 6_2_019253CA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A1BE9 mov eax, dword ptr fs:[00000030h] 6_2_018A1BE9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CDBE9 mov eax, dword ptr fs:[00000030h] 6_2_018CDBE9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h] 6_2_018D03E2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019523E3 mov ecx, dword ptr fs:[00000030h] 6_2_019523E3
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019523E3 mov ecx, dword ptr fs:[00000030h] 6_2_019523E3
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019523E3 mov eax, dword ptr fs:[00000030h] 6_2_019523E3
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h] 6_2_018CA309
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196131B mov eax, dword ptr fs:[00000030h] 6_2_0196131B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018ADB40 mov eax, dword ptr fs:[00000030h] 6_2_018ADB40
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01978B58 mov eax, dword ptr fs:[00000030h] 6_2_01978B58
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AF358 mov eax, dword ptr fs:[00000030h] 6_2_018AF358
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h] 6_2_018D3B5A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h] 6_2_018D3B5A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h] 6_2_018D3B5A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h] 6_2_018D3B5A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018ADB60 mov ecx, dword ptr fs:[00000030h] 6_2_018ADB60
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01936365 mov eax, dword ptr fs:[00000030h] 6_2_01936365
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01936365 mov eax, dword ptr fs:[00000030h] 6_2_01936365
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01936365 mov eax, dword ptr fs:[00000030h] 6_2_01936365
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B7A mov eax, dword ptr fs:[00000030h] 6_2_018D3B7A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D3B7A mov eax, dword ptr fs:[00000030h] 6_2_018D3B7A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h] 6_2_018BF370
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h] 6_2_018BF370
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h] 6_2_018BF370
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DDA88 mov eax, dword ptr fs:[00000030h] 6_2_018DDA88
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DDA88 mov eax, dword ptr fs:[00000030h] 6_2_018DDA88
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196129A mov eax, dword ptr fs:[00000030h] 6_2_0196129A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DD294 mov eax, dword ptr fs:[00000030h] 6_2_018DD294
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DD294 mov eax, dword ptr fs:[00000030h] 6_2_018DD294
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A1AA0 mov eax, dword ptr fs:[00000030h] 6_2_018A1AA0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D5AA0 mov eax, dword ptr fs:[00000030h] 6_2_018D5AA0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D5AA0 mov eax, dword ptr fs:[00000030h] 6_2_018D5AA0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h] 6_2_018A52A5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h] 6_2_018A52A5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h] 6_2_018A52A5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h] 6_2_018A52A5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h] 6_2_018A52A5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D12BD mov esi, dword ptr fs:[00000030h] 6_2_018D12BD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D12BD mov eax, dword ptr fs:[00000030h] 6_2_018D12BD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D12BD mov eax, dword ptr fs:[00000030h] 6_2_018D12BD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BAAB0 mov eax, dword ptr fs:[00000030h] 6_2_018BAAB0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BAAB0 mov eax, dword ptr fs:[00000030h] 6_2_018BAAB0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DFAB0 mov eax, dword ptr fs:[00000030h] 6_2_018DFAB0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A3ACA mov eax, dword ptr fs:[00000030h] 6_2_018A3ACA
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2ACB mov eax, dword ptr fs:[00000030h] 6_2_018D2ACB
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h] 6_2_018A5AC0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h] 6_2_018A5AC0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h] 6_2_018A5AC0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01978ADD mov eax, dword ptr fs:[00000030h] 6_2_01978ADD
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A12D4 mov eax, dword ptr fs:[00000030h] 6_2_018A12D4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2AE4 mov eax, dword ptr fs:[00000030h] 6_2_018D2AE4
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h] 6_2_01964AEF
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196AA16 mov eax, dword ptr fs:[00000030h] 6_2_0196AA16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196AA16 mov eax, dword ptr fs:[00000030h] 6_2_0196AA16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018B8A0A mov eax, dword ptr fs:[00000030h] 6_2_018B8A0A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018C3A1C mov eax, dword ptr fs:[00000030h] 6_2_018C3A1C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h] 6_2_018A5210
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5210 mov ecx, dword ptr fs:[00000030h] 6_2_018A5210
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h] 6_2_018A5210
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h] 6_2_018A5210
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AAA16 mov eax, dword ptr fs:[00000030h] 6_2_018AAA16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018AAA16 mov eax, dword ptr fs:[00000030h] 6_2_018AAA16
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E4A2C mov eax, dword ptr fs:[00000030h] 6_2_018E4A2C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E4A2C mov eax, dword ptr fs:[00000030h] 6_2_018E4A2C
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h] 6_2_018CA229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A4A20 mov eax, dword ptr fs:[00000030h] 6_2_018A4A20
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A4A20 mov eax, dword ptr fs:[00000030h] 6_2_018A4A20
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h] 6_2_018A8239
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h] 6_2_018A8239
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h] 6_2_018A8239
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h] 6_2_018CB236
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961229 mov eax, dword ptr fs:[00000030h] 6_2_01961229
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196EA55 mov eax, dword ptr fs:[00000030h] 6_2_0196EA55
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01934257 mov eax, dword ptr fs:[00000030h] 6_2_01934257
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01961A5F mov eax, dword ptr fs:[00000030h] 6_2_01961A5F
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h] 6_2_018A9240
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h] 6_2_018A9240
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h] 6_2_018A9240
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h] 6_2_018A9240
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h] 6_2_018E5A69
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h] 6_2_018E5A69
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h] 6_2_018E5A69
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018E927A mov eax, dword ptr fs:[00000030h] 6_2_018E927A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0195B260 mov eax, dword ptr fs:[00000030h] 6_2_0195B260
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0195B260 mov eax, dword ptr fs:[00000030h] 6_2_0195B260
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01978A62 mov eax, dword ptr fs:[00000030h] 6_2_01978A62
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h] 6_2_018A2D8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h] 6_2_018A2D8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h] 6_2_018A2D8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h] 6_2_018A2D8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h] 6_2_018A2D8A
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h] 6_2_018D2581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h] 6_2_018D2581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h] 6_2_018D2581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h] 6_2_018D2581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h] 6_2_01962D82
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DFD9B mov eax, dword ptr fs:[00000030h] 6_2_018DFD9B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018DFD9B mov eax, dword ptr fs:[00000030h] 6_2_018DFD9B
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h] 6_2_0196B581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h] 6_2_0196B581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h] 6_2_0196B581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h] 6_2_0196B581
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A3591 mov eax, dword ptr fs:[00000030h] 6_2_018A3591
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D35A1 mov eax, dword ptr fs:[00000030h] 6_2_018D35A1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h] 6_2_018D65A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h] 6_2_018D65A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h] 6_2_018D65A0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h] 6_2_018D1DB5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h] 6_2_018D1DB5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h] 6_2_018D1DB5
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019705AC mov eax, dword ptr fs:[00000030h] 6_2_019705AC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_019705AC mov eax, dword ptr fs:[00000030h] 6_2_019705AC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0195FDD3 mov eax, dword ptr fs:[00000030h] 6_2_0195FDD3
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A15C1 mov eax, dword ptr fs:[00000030h] 6_2_018A15C1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov ecx, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h] 6_2_01926DC9
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018D95EC mov eax, dword ptr fs:[00000030h] 6_2_018D95EC
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01958DF1 mov eax, dword ptr fs:[00000030h] 6_2_01958DF1
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BD5E0 mov eax, dword ptr fs:[00000030h] 6_2_018BD5E0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018BD5E0 mov eax, dword ptr fs:[00000030h] 6_2_018BD5E0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h] 6_2_0196FDE2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h] 6_2_0196FDE2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h] 6_2_0196FDE2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h] 6_2_0196FDE2
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A95F0 mov eax, dword ptr fs:[00000030h] 6_2_018A95F0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_018A95F0 mov ecx, dword ptr fs:[00000030h] 6_2_018A95F0
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01963518 mov eax, dword ptr fs:[00000030h] 6_2_01963518
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01963518 mov eax, dword ptr fs:[00000030h] 6_2_01963518
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Code function: 6_2_01963518 mov eax, dword ptr fs:[00000030h] 6_2_01963518
Enables debug privileges
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Memory written: C:\Users\user\Desktop\DHL_document11022020680908006.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Process created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Users\user\Desktop\DHL_document11022020680908006.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 385270 Sample: DHL_document11022020680908006.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 18 Found malware configuration 2->18 20 Malicious sample detected (through community Yara rule) 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 5 other signatures 2->24 6 DHL_document11022020680908006.exe 3 2->6         started        process3 file4 16 C:\...\DHL_document11022020680908006.exe.log, ASCII 6->16 dropped 26 Tries to detect virtualization through RDTSC time measurements 6->26 28 Injects a PE file into a foreign processes 6->28 10 DHL_document11022020680908006.exe 6->10         started        12 DHL_document11022020680908006.exe 6->12         started        14 DHL_document11022020680908006.exe 6->14         started        signatures5 process6
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.bendhighswimming.com/crdi/ true
  • Avira URL Cloud: safe
 low