Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report DHL_document11022020680908006.exe

Overview

General Information

Sample Name:DHL_document11022020680908006.exe
Analysis ID:385270
MD5:68d63479e5a11048e6bc1eaa242f8c7b
SHA1:8637b7ec04a9ff11b8fc6d99a51f911aaad5a889
SHA256:0bc287a98874b2ba0b818013c4026180a2e210a65d0800a169dde7ad7725277b
Tags:CHNDHLexeFormbookgeo
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.bendhighswimming.com/crdi/"], "decoy": ["propertyjumpstartwebinar.com", "boc-vip.club", "polestarnyc.com", "travelonlinebiz.com", "bukovynaent.com", "bestfashoin.com", "miniindiastore.com", "wehatebillgates.com", "holmescountyjusticecourt.com", "colectivorenovemosjuntos.com", "houstowarehouse.com", "aocsw.com", "sml-uniform.com", "bandanasaint.com", "petposhdeluxe.com", "ezcscpawq.com", "ladiesoption.club", "refixu.com", "selfwrrrth.com", "rovietry.com", "enaoc.com", "karyolaw.com", "diversitymarketingtx.net", "browsersentenderbanco.net", "samtheshepherd.com", "nash-arbitrazh.com", "gampang-kerja.tech", "ereplacementparrts.com", "eventmidasbuy14.com", "sia-rikvel.com", "top2016.net", "686638.com", "ton.blue", "desktower.net", "dbykq020.com", "stack30.com", "tiendasfotoprix.com", "kylesmaier.com", "ekmantsang.com", "jumlasx.xyz", "qingqingyuyin.com", "cdnsubs.xyz", "maxamoose.com", "huelling.com", "xn--bjrnnstet-z2a8q.online", "betale-posten.com", "lalatendu.info", "nochipmanicure.net", "bichat.website", "washington32reds.com", "centrodesaludcrecer.com", "phihoteldeimedaglioni.com", "kilmalliefarms.com", "icecreamsocialwp.com", "mac-makeup.club", "elzooz.com", "iqomw.com", "bestattorneycle.com", "startonsocial.com", "purensoessentials.com", "therealyolandafay.com", "feildwolf.com", "nativesupps.com", "nbatimeout.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x161fe0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x16225a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x18e800:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x18ea7a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x16dd7d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x19a59d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x16d869:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x19a089:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x16de7f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x19a69f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x16dff7:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x19a817:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x162c72:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x18f492:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x16cae4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x199304:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x16396b:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19018b:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x173bef:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1a040f:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x174bf2:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x170b11:$sqlite3step: 68 34 1C 7B E1
    • 0x170c24:$sqlite3step: 68 34 1C 7B E1
    • 0x19d331:$sqlite3step: 68 34 1C 7B E1
    • 0x19d444:$sqlite3step: 68 34 1C 7B E1
    • 0x170b40:$sqlite3text: 68 38 2A 90 C5
    • 0x170c65:$sqlite3text: 68 38 2A 90 C5
    • 0x19d360:$sqlite3text: 68 38 2A 90 C5
    • 0x19d485:$sqlite3text: 68 38 2A 90 C5
    • 0x170b53:$sqlite3blob: 68 53 D8 7F 8C
    • 0x170c7b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x19d373:$sqlite3blob: 68 53 D8 7F 8C
    • 0x19d49b:$sqlite3blob: 68 53 D8 7F 8C
    00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
      00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
        Click to see the 3 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        6.2.DHL_document11022020680908006.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          6.2.DHL_document11022020680908006.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1a6f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1b6fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          6.2.DHL_document11022020680908006.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17619:$sqlite3step: 68 34 1C 7B E1
          • 0x1772c:$sqlite3step: 68 34 1C 7B E1
          • 0x17648:$sqlite3text: 68 38 2A 90 C5
          • 0x1776d:$sqlite3text: 68 38 2A 90 C5
          • 0x1765b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17783:$sqlite3blob: 68 53 D8 7F 8C
          6.2.DHL_document11022020680908006.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
            6.2.DHL_document11022020680908006.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
            • 0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
            • 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
            • 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
            • 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
            • 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
            • 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
            • 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
            • 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D
            • 0x1b4f7:$sequence_8: 3C 54 74 04 3C 74 75 F4
            • 0x1c4fa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
            Click to see the 1 entries

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.bendhighswimming.com/crdi/"], "decoy": ["propertyjumpstartwebinar.com", "boc-vip.club", "polestarnyc.com", "travelonlinebiz.com", "bukovynaent.com", "bestfashoin.com", "miniindiastore.com", "wehatebillgates.com", "holmescountyjusticecourt.com", "colectivorenovemosjuntos.com", "houstowarehouse.com", "aocsw.com", "sml-uniform.com", "bandanasaint.com", "petposhdeluxe.com", "ezcscpawq.com", "ladiesoption.club", "refixu.com", "selfwrrrth.com", "rovietry.com", "enaoc.com", "karyolaw.com", "diversitymarketingtx.net", "browsersentenderbanco.net", "samtheshepherd.com", "nash-arbitrazh.com", "gampang-kerja.tech", "ereplacementparrts.com", "eventmidasbuy14.com", "sia-rikvel.com", "top2016.net", "686638.com", "ton.blue", "desktower.net", "dbykq020.com", "stack30.com", "tiendasfotoprix.com", "kylesmaier.com", "ekmantsang.com", "jumlasx.xyz", "qingqingyuyin.com", "cdnsubs.xyz", "maxamoose.com", "huelling.com", "xn--bjrnnstet-z2a8q.online", "betale-posten.com", "lalatendu.info", "nochipmanicure.net", "bichat.website", "washington32reds.com", "centrodesaludcrecer.com", "phihoteldeimedaglioni.com", "kilmalliefarms.com", "icecreamsocialwp.com", "mac-makeup.club", "elzooz.com", "iqomw.com", "bestattorneycle.com", "startonsocial.com", "purensoessentials.com", "therealyolandafay.com", "feildwolf.com", "nativesupps.com", "nbatimeout.com"]}
            Multi AV Scanner detection for submitted fileShow sources
            Source: DHL_document11022020680908006.exeReversingLabs: Detection: 25%
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
            Source: DHL_document11022020680908006.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
            Source: DHL_document11022020680908006.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: DHL_document11022020680908006.exe, 00000006.00000002.259975111.0000000001880000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4x nop then mov dword ptr [ebp-18h], 00000000h

            Networking:

            barindex
            C2 URLs / IPs found in malware configurationShow sources
            Source: Malware configuration extractorURLs: www.bendhighswimming.com/crdi/
            Source: DHL_document11022020680908006.exe, 00000000.00000003.233610834.000000000120D000.00000004.00000001.sdmpString found in binary or memory: http://en.wQ
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
            Source: DHL_document11022020680908006.exe, 00000000.00000003.236661880.0000000005B70000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.com?
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
            Source: DHL_document11022020680908006.exe, 00000000.00000003.240077453.0000000005B69000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers-
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
            Source: DHL_document11022020680908006.exe, 00000000.00000003.240581343.0000000005B6D000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersY
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270290969.0000000005B60000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.coma
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234336459.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comn
            Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
            Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn-
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
            Source: DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnl-g&
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
            Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp//
            Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ana
            Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/iva
            Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
            Source: DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/_
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000003.233917646.0000000005B81000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com5
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
            Source: DHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
            Source: DHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.krntact
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comU
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234707922.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comh
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234663283.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.coml
            Source: DHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comnh
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
            Source: DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpString found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

            E-Banking Fraud:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
            Initial sample is a PE file and has a suspicious nameShow sources
            Source: initial sampleStatic PE information: Filename: DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041A060 NtClose,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041A110 NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00419F30 NtCreateFile,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00419FE0 NtReadFile,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041A05A NtClose,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041A10C NtAllocateVirtualMemory,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00419FDA NtReadFile,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E96E0 NtFreeVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9660 NtAllocateVirtualMemory,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E99A0 NtCreateSection,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E99D0 NtCreateProcessEx,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9910 NtAdjustPrivilegesToken,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9950 NtQueueApcThread,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E98A0 NtWriteVirtualMemory,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E98F0 NtReadVirtualMemory,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9820 NtEnumerateKey,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018EB040 NtSuspendThread,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9840 NtDelayExecution,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018EA3B0 NtGetContextThread,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9B00 NtSetValueKey,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9A80 NtOpenDirectoryObject,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9A00 NtProtectVirtualMemory,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9A10 NtQuerySection,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9A20 NtResumeThread,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9A50 NtCreateFile,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E95D0 NtClose,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E95F0 NtQueryInformationFile,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_00714D16
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_0071869D
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B8168
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B0960
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B13B0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B1A6B
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B55FC
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B6CC8
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B0915
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B5038
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B4DF0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B55F0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B540F
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B6CBF
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B2E08
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B5638
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B5647
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B6EE9
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_02ABC428
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_02AB9890
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_002F4D16
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_002F869D
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_00254D16
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_0025869D
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00401029
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00401030
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D173
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041E3E6
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041DBBB
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00402D87
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D589
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00402D90
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00409E40
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00409E3B
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041DFAA
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00402FB0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00DE4D16
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00DE869D
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C2990
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AF900
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BB090
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019720A8
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019728EC
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A6800
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961002
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0197E824
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA830
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D138B
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CEB9A
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194EB8A
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DEBB0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196DBD2
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019603DA
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DABD8
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018F8BE8
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019523E3
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196231B
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01972B28
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CAB40
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194CB4F
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C3360
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019722AE
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019732A9
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196E2C5
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0195FA2B
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2581
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D65A0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019725DD
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BD5E0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01972D07
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: String function: 018AB150 appears 88 times
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: String function: 01935720 appears 47 times
            Source: DHL_document11022020680908006.exe, 00000000.00000002.272033610.00000000077C0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameSimpleUI.dll2 vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000000.00000000.231107081.00000000007C6000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000000.00000002.271515431.0000000007150000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameDSASignature.dll" vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000003.00000002.255099385.00000000003A6000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000004.00000000.255948475.0000000000306000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000006.00000002.259562052.0000000000E96000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exe, 00000006.00000002.260362622.0000000001B2F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exeBinary or memory string: OriginalFilenameResolveEventHandler.exe> vs DHL_document11022020680908006.exe
            Source: DHL_document11022020680908006.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
            Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
            Source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
            Source: DHL_document11022020680908006.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: classification engineClassification label: mal100.troj.evad.winEXE@7/1@0/0
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_document11022020680908006.exe.logJump to behavior
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeMutant created: \Sessions\1\BaseNamedObjects\NIuDJQPdpTkCF
            Source: DHL_document11022020680908006.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: Select * from Clientes WHERE id=@id;;
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
            Source: DHL_document11022020680908006.exeReversingLabs: Detection: 25%
            Source: unknownProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe 'C:\Users\user\Desktop\DHL_document11022020680908006.exe'
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
            Source: DHL_document11022020680908006.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: DHL_document11022020680908006.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
            Source: Binary string: wntdll.pdbUGP source: DHL_document11022020680908006.exe, 00000006.00000002.259975111.0000000001880000.00000040.00000001.sdmp
            Source: Binary string: wntdll.pdb source: DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_007BB088 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_007BA258 push edi; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_007B8F6B push FFFFFFFEh; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_007B8B14 pushfd ; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_007BA30F push ebx; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 0_2_011B4590 push FFFFFFA0h; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_0039B088 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_0039A258 push edi; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_00398B14 pushfd ; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_0039A30F push ebx; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 3_2_00398F6B push FFFFFFFEh; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_002FB088 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_002FA258 push edi; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_002FA30F push ebx; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_002F8B14 pushfd ; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 4_2_002F8F6B push FFFFFFFEh; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041C875 push ss; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041C811 push ss; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D0D2 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D0DB push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D085 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041D13C push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0041A1C6 pushfd ; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00419AC6 push edx; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00407B28 push FFFFFFC4h; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00416B8B push cs; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00E8B088 push eax; ret
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00E8A258 push edi; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00E8A30F push ebx; retf
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00E88B14 pushfd ; iretd
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00E88F6B push FFFFFFFEh; retf
            Source: initial sampleStatic PE information: section name: .text entropy: 7.95739583157
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion:

            barindex
            Yara detected AntiVM3Show sources
            Source: Yara matchFile source: 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: DHL_document11022020680908006.exe PID: 240, type: MEMORY
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
            Tries to detect virtualization through RDTSC time measurementsShow sources
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeRDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeRDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 5292Thread sleep time: -103301s >= -30000s
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 5288Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exe TID: 2248Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeThread delayed: delay time: 103301
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeThread delayed: delay time: 922337203685477
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: vmware
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: VMWARE
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
            Source: DHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess queried: DebugPort
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_00409A90 rdtsc
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E9860 NtQuerySystemInformation,LdrInitializeThunk,
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DA185 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CC182 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A519E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A519E mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2990 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D4190 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196A189 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196A189 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0197F1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0197F1B5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019251BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019251BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019251BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019251BE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B61A7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D61A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D61A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019649A4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DC9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DC9BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C99BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019269A6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B99C7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019619D8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A31E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AB1E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019789E7 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019341E8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B0100 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C4120 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A3138 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D513A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961951 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB944 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A395E mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AC962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01978966 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196E962 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AB171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AB171 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9080 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A3880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A3880 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01923884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01923884 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E90AF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28AE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D20A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D78A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DF0BF mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DF0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DF0BF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0193B8D0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A70C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A70C0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019618CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A58EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB8E4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A40E1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B28FD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01974015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01974015 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01927016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01927016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01927016 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A6800 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D002D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BB02A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D4020 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA830 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961843 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C0050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C0050 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A7057 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CF86D mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01971074 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962073 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B1B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B1B8F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D138B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0195D380 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CEB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CEB9A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2397 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196138A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DB390 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194EB8A mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0194EB8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A4B94 mov edi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D4BAD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01978BB6 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01979BBE mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01975BA5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961BA8 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D53C5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019253CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019253CA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A1BE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CDBE9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D03E2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019523E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019523E3 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019523E3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA309 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196131B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018ADB40 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01978B58 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AF358 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B5A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018ADB60 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01936365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01936365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01936365 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D3B7A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BF370 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DDA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DDA88 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196129A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DD294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DD294 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A1AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D5AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D5AA0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A52A5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D12BD mov esi, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D12BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D12BD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BAAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BAAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DFAB0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A3ACA mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2ACB mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5AC0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01978ADD mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A12D4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2AE4 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01964AEF mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196AA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018B8A0A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018C3A1C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5210 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A5210 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AAA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018AAA16 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E4A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E4A2C mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CA229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A4A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A4A20 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A8239 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018CB236 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961229 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196EA55 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01934257 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01961A5F mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A9240 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E5A69 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018E927A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0195B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0195B260 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01978A62 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A2D8A mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D2581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01962D82 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DFD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018DFD9B mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196B581 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A3591 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D35A1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D65A0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D1DB5 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019705AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_019705AC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0195FDD3 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A15C1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01926DC9 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018D95EC mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01958DF1 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BD5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018BD5E0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_0196FDE2 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A95F0 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_018A95F0 mov ecx, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01963518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01963518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeCode function: 6_2_01963518 mov eax, dword ptr fs:[00000030h]
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeMemory allocated: page read and write | page guard

            HIPS / PFW / Operating System Protection Evasion:

            barindex
            Injects a PE file into a foreign processesShow sources
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeMemory written: C:\Users\user\Desktop\DHL_document11022020680908006.exe base: 400000 value starts with: 4D5A
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeProcess created: C:\Users\user\Desktop\DHL_document11022020680908006.exe C:\Users\user\Desktop\DHL_document11022020680908006.exe
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Users\user\Desktop\DHL_document11022020680908006.exe VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
            Source: C:\Users\user\Desktop\DHL_document11022020680908006.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Stealing of Sensitive Information:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE

            Remote Access Functionality:

            barindex
            Yara detected FormBookShow sources
            Source: Yara matchFile source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, type: MEMORY
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 6.2.DHL_document11022020680908006.exe.400000.0.raw.unpack, type: UNPACKEDPE

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection111Masquerading1OS Credential DumpingSecurity Software Discovery221Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion31Security Account ManagerVirtualization/Sandbox Evasion31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection111NTDSSystem Information Discovery112Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information4Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            DHL_document11022020680908006.exe25%ReversingLabsByteCode-MSIL.Spyware.Noon

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            6.2.DHL_document11022020680908006.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

            Domains

            No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
            http://www.sajatypeworks.com50%Avira URL Cloudsafe
            http://en.wQ0%Avira URL Cloudsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.tiro.com0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.goodfont.co.kr0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
            http://www.fontbureau.coma0%URL Reputationsafe
            http://www.fontbureau.coma0%URL Reputationsafe
            http://www.fontbureau.coma0%URL Reputationsafe
            http://www.fontbureau.coma0%URL Reputationsafe
            http://www.tiro.comnh0%Avira URL Cloudsafe
            http://www.founder.com.cn/cnl-g&0%Avira URL Cloudsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.carterandcone.coml0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.sajatypeworks.com0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.typography.netD0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/jp/_0%Avira URL Cloudsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://fontfabrik.com0%URL Reputationsafe
            http://www.carterandcone.com?0%Avira URL Cloudsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.founder.com.cn/cn0%URL Reputationsafe
            http://www.founder.com.cn/cn-0%Avira URL Cloudsafe
            www.bendhighswimming.com/crdi/0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp//0%URL Reputationsafe
            http://www.tiro.comU0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
            http://www.sandoll.co.krntact0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/ana0%Avira URL Cloudsafe
            http://www.jiyu-kobo.co.jp/iva0%Avira URL Cloudsafe
            http://www.fonts.comn0%URL Reputationsafe
            http://www.fonts.comn0%URL Reputationsafe
            http://www.fonts.comn0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
            http://www.tiro.coml0%Avira URL Cloudsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.sandoll.co.kr0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.urwpp.deDPlease0%URL Reputationsafe
            http://www.tiro.comh0%Avira URL Cloudsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.zhongyicts.com.cn0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe
            http://www.sakkal.com0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            No contacted domains info

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            www.bendhighswimming.com/crdi/true
            • Avira URL Cloud: safe
            		low

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://www.apache.org/licenses/LICENSE-2.0DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
              		high
              http://www.fontbureau.comDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                		high
                http://www.fontbureau.com/designersGDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                  		high
                  http://www.fontbureau.com/designers/?DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                    		high
                    http://www.founder.com.cn/cn/bTheDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    		unknown
                    http://www.sajatypeworks.com5DHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.fontbureau.com/designers?DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                      		high
                      http://en.wQDHL_document11022020680908006.exe, 00000000.00000003.233610834.000000000120D000.00000004.00000001.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://www.fontbureau.com/designersYDHL_document11022020680908006.exe, 00000000.00000003.240581343.0000000005B6D000.00000004.00000001.sdmpfalse
                        		high
                        http://www.tiro.comDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designersDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                          		high
                          http://www.goodfont.co.krDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/jp/DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.comaDHL_document11022020680908006.exe, 00000000.00000002.270290969.0000000005B60000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          • URL Reputation: safe
                          		unknown
                          http://www.tiro.comnhDHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.founder.com.cn/cnl-g&DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.cssDHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpfalse
                            		high
                            http://www.carterandcone.comlDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comDHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000003.233917646.0000000005B81000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.typography.netDDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.fontbureau.com/designers/cabarga.htmlNDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/cTheDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.jiyu-kobo.co.jp/jp/_DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.galapagosdesign.com/staff/dennis.htmDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://fontfabrik.comDHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmp, DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.carterandcone.com?DHL_document11022020680908006.exe, 00000000.00000003.236661880.0000000005B70000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.founder.com.cn/cnDHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designers-DHL_document11022020680908006.exe, 00000000.00000003.240077453.0000000005B69000.00000004.00000001.sdmpfalse
                                		high
                                http://www.fontbureau.com/designers/frere-jones.htmlDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                  		high
                                  http://www.founder.com.cn/cn-DHL_document11022020680908006.exe, 00000000.00000003.236076294.0000000005B9D000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp//DHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.tiro.comUDHL_document11022020680908006.exe, 00000000.00000003.234631685.0000000005B7B000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.sandoll.co.krntactDHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/anaDHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/ivaDHL_document11022020680908006.exe, 00000000.00000003.237443454.0000000005B64000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fonts.comnDHL_document11022020680908006.exe, 00000000.00000003.234336459.0000000005B7B000.00000004.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.galapagosdesign.com/DPleaseDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.com/designers8DHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                    		high
                                    http://www.tiro.comlDHL_document11022020680908006.exe, 00000000.00000003.234663283.0000000005B7B000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.fonts.comDHL_document11022020680908006.exe, 00000000.00000003.234241493.0000000005B7B000.00000004.00000001.sdmpfalse
                                      		high
                                      http://www.sandoll.co.krDHL_document11022020680908006.exe, 00000000.00000003.235507174.0000000005B69000.00000004.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.urwpp.deDPleaseDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.tiro.comhDHL_document11022020680908006.exe, 00000000.00000003.234707922.0000000005B7B000.00000004.00000001.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.zhongyicts.com.cnDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameDHL_document11022020680908006.exe, 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmpfalse
                                        		high
                                        http://www.sakkal.comDHL_document11022020680908006.exe, 00000000.00000002.270383669.0000000005C50000.00000002.00000001.sdmpfalse
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        • URL Reputation: safe
                                        		unknown

                                        Contacted IPs

                                        No contacted IP infos

                                        General Information

                                        Joe Sandbox Version:31.0.0 Emerald
                                        Analysis ID:385270
                                        Start date:12.04.2021
                                        Start time:09:22:23
                                        Joe Sandbox Product:CloudBasic
                                        Overall analysis duration:0h 10m 28s
                                        Hypervisor based Inspection enabled:false
                                        Report type:light
                                        Sample file name:DHL_document11022020680908006.exe
                                        Cookbook file name:default.jbs
                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                        Number of analysed new started processes analysed:27
                                        Number of new started drivers analysed:0
                                        Number of existing processes analysed:0
                                        Number of existing drivers analysed:0
                                        Number of injected processes analysed:0
                                        Technologies:
                                        • HCA enabled
                                        • EGA enabled
                                        • HDC enabled
                                        • AMSI enabled
                                        Analysis Mode:default
                                        Analysis stop reason:Timeout
                                        Detection:MAL
                                        Classification:mal100.troj.evad.winEXE@7/1@0/0
                                        EGA Information:Failed
                                        HDC Information:
                                        • Successful, ratio: 4.4% (good quality ratio 4.3%)
                                        • Quality average: 78.8%
                                        • Quality standard deviation: 26%
                                        HCA Information:
                                        • Successful, ratio: 100%
                                        • Number of executed functions: 0
                                        • Number of non-executed functions: 0
                                        Cookbook Comments:
                                        • Adjust boot time
                                        • Enable AMSI
                                        • Found application associated with file extension: .exe
                                        Warnings:
                                        Show All
                                        • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                        Simulations

                                        Behavior and APIs

                                        TimeTypeDescription
                                        09:23:25API Interceptor1x Sleep call for process: DHL_document11022020680908006.exe modified

                                        Joe Sandbox View / Context

                                        IPs

                                        No context

                                        Domains

                                        No context

                                        ASN

                                        No context

                                        JA3 Fingerprints

                                        No context

                                        Dropped Files

                                        No context

                                        Created / dropped Files

                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_document11022020680908006.exe.log
                                        Process:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        File Type:ASCII text, with CRLF line terminators
                                        Category:dropped
                                        Size (bytes):1314
                                        Entropy (8bit):5.350128552078965
                                        Encrypted:false
                                        SSDEEP:24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
                                        MD5:1DC1A2DCC9EFAA84EABF4F6D6066565B
                                        SHA1:B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
                                        SHA-256:28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
                                        SHA-512:95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
                                        Malicious:true
                                        Reputation:high, very likely benign file
                                        Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                        Static File Info

                                        General

                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                        Entropy (8bit):7.93482342995501
                                        TrID:
                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                        • Win32 Executable (generic) a (10002005/4) 49.75%
                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                        • Windows Screen Saver (13104/52) 0.07%
                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                        File name:DHL_document11022020680908006.exe
                                        File size:744448
                                        MD5:68d63479e5a11048e6bc1eaa242f8c7b
                                        SHA1:8637b7ec04a9ff11b8fc6d99a51f911aaad5a889
                                        SHA256:0bc287a98874b2ba0b818013c4026180a2e210a65d0800a169dde7ad7725277b
                                        SHA512:424d57f5c6277e9422625d1b866678f31de6e378bde989e6c1b8de7a08f97946183e6116901402c51a923b1fa34f0ac792d78170cc89dbc75e0275651aa685a9
                                        SSDEEP:12288:sU4W5j63HmMBIV/v5v5apvsNnAFNIRLJVdJX3cWOkJkPrr2Hx1mM8UV3EkrohWW0:N4UV/ap0RaNIRLJVdJXyix1msV0kU4Em
                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...|.s`.....................L.......-... ...@....@.. ....................................@................................

                                        File Icon

                                        Icon Hash:ec8633512db2d0f1

                                        Static PE Info

                                        General

                                        Entrypoint:0x4b2dbe
                                        Entrypoint Section:.text
                                        Digitally signed:false
                                        Imagebase:0x400000
                                        Subsystem:windows gui
                                        Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                                        DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                        Time Stamp:0x6073947C [Mon Apr 12 00:29:48 2021 UTC]
                                        TLS Callbacks:
                                        CLR (.Net) Version:v4.0.30319
                                        OS Version Major:4
                                        OS Version Minor:0
                                        File Version Major:4
                                        File Version Minor:0
                                        Subsystem Version Major:4
                                        Subsystem Version Minor:0
                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                        Entrypoint Preview

                                        Instruction
                                        jmp dword ptr [00402000h]
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al
                                        add byte ptr [eax], al

                                        Data Directories

                                        NameVirtual AddressVirtual Size Is in Section
                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xb2d640x57.text
                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xb60000x48b0.rsrc
                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0xb40000xc.reloc
                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                        Sections

                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                        .text0x20000xb0dc40xb0e00False0.957162378534data7.95739583157IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                        .reloc0xb40000xc0x200False0.044921875data0.101910425663IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                        .rsrc0xb60000x48b00x4a00False0.367609797297data5.84280610658IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                        Resources

                                        NameRVASizeTypeLanguageCountry
                                        RT_ICON0xb61300x4228dBase III DBT, version number 0, next free block index 40
                                        RT_GROUP_ICON0xba3580x14data
                                        RT_VERSION0xba36c0x38edata
                                        RT_MANIFEST0xba6fc0x1b4XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

                                        Imports

                                        DLLImport
                                        mscoree.dll_CorExeMain

                                        Version Infos

                                        DescriptionData
                                        Translation0x0000 0x04b0
                                        LegalCopyrightCopyright 2012
                                        Assembly Version8.1.1.15
                                        InternalNameResolveEventHandler.exe
                                        FileVersion8.1.1.14
                                        CompanyNameLandskip Yard Care
                                        LegalTrademarksA++
                                        Comments
                                        ProductNameLevelActivator
                                        ProductVersion8.1.1.14
                                        FileDescriptionLevelActivator
                                        OriginalFilenameResolveEventHandler.exe

                                        Network Behavior

                                        No network behavior found

                                        Code Manipulations

                                        Statistics

                                        Behavior

                                        Click to jump to process

                                        System Behavior

                                        Analysis Process: DHL_document11022020680908006.exe PID: 240 Parent PID: 5696

                                        General

                                        Start time:09:23:16
                                        Start date:12/04/2021
                                        Path:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Wow64 process (32bit):true
                                        Commandline:'C:\Users\user\Desktop\DHL_document11022020680908006.exe'
                                        Imagebase:0x710000
                                        File size:744448 bytes
                                        MD5 hash:68D63479E5A11048E6BC1EAA242F8C7B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:.Net C# or VB.NET
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, Author: Joe Security
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.260561462.0000000003C98000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                        • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.259818471.0000000002AF1000.00000004.00000001.sdmp, Author: Joe Security
                                        Reputation:low

                                        Analysis Process: DHL_document11022020680908006.exe PID: 3696 Parent PID: 240

                                        General

                                        Start time:09:23:27
                                        Start date:12/04/2021
                                        Path:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Imagebase:0x2f0000
                                        File size:744448 bytes
                                        MD5 hash:68D63479E5A11048E6BC1EAA242F8C7B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low

                                        Analysis Process: DHL_document11022020680908006.exe PID: 3568 Parent PID: 240

                                        General

                                        Start time:09:23:28
                                        Start date:12/04/2021
                                        Path:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Wow64 process (32bit):false
                                        Commandline:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Imagebase:0x250000
                                        File size:744448 bytes
                                        MD5 hash:68D63479E5A11048E6BC1EAA242F8C7B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Reputation:low

                                        Analysis Process: DHL_document11022020680908006.exe PID: 5876 Parent PID: 240

                                        General

                                        Start time:09:23:28
                                        Start date:12/04/2021
                                        Path:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Wow64 process (32bit):true
                                        Commandline:C:\Users\user\Desktop\DHL_document11022020680908006.exe
                                        Imagebase:0xde0000
                                        File size:744448 bytes
                                        MD5 hash:68D63479E5A11048E6BC1EAA242F8C7B
                                        Has elevated privileges:true
                                        Has administrator privileges:true
                                        Programmed in:C, C++ or other language
                                        Yara matches:
                                        • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                                        • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                        • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.259139360.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                                        Reputation:low

                                        Disassembly

                                        Code Analysis

                                        Reset < >