Windows Analysis Report
DHL - OVERDUE ACCOUNT - 130115482244.exe

Overview

General Information

Sample Name: DHL - OVERDUE ACCOUNT - 130115482244.exe
Analysis ID: 635262
MD5: 3aadebe9b94245452d74c655b2f04c0d
SHA1: 794dc763ca693288850d9a8ab73848d8146e19a7
SHA256: d9005fbd977fd39146b129fb7e391765242be7857ba9dd921dc59339ce90d06d
Tags: AgentTeslaDHLexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Yara detected Credential Stealer
Creates processes with suspicious names
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Found malware configuration
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "ventas@mftecnologia.com.uy", "Password": "Ventas.1", "Host": "us2.smtp.mailhostbox.com"}
Multi AV Scanner detection for submitted file
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Virustotal: Detection: 32% Perma Link
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe ReversingLabs: Detection: 20%
Antivirus or Machine Learning detection for unpacked file
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Uses 32bit PE files
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\cQsBHRkRnH\src\obj\x86\Debug\BadImageFormatExcept.pdb source: DHL - OVERDUE ACCOUNT - 130115482244.exe
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.38 208.91.198.38
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49774 -> 208.91.198.38:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.6:49774 -> 208.91.198.38:587
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://EBusCZ.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646171497.000000000179D000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000003.457152654.000000000179F000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646980534.0000000003543000.00000004.00000800.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646855464.0000000003513000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://gmhwAFOW85IGv.org
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646171497.000000000179D000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000003.457152654.000000000179F000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0A
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.423839638.0000000001817000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com_/
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.423839638.0000000001817000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.423839638.0000000001817000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgrita
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.430878005.0000000007302000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe String found in binary or memory: https://github.com
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe String found in binary or memory: https://github.com/dcoetzee/plants-vs-zombies-user-file-editor
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.647118757.000000000354D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: unknown DNS traffic detected: queries for: us2.smtp.mailhostbox.com
Creates a DirectInput object (often for capturing keystrokes)
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.423191668.00000000015BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.7a40000.9.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.7a40000.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000000.00000002.433764816.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects zgRAT Author: ditekSHen
.NET source code contains very large array initializations
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b2D7B5E04u002d9E20u002d4A39u002dAECCu002dF413E455BDF7u007d/u0035727597Fu002d90A1u002d476Bu002d838Fu002d3B50A6BAB817.cs Large array initialization: .cctor: array initializer size 11605
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b2D7B5E04u002d9E20u002d4A39u002dAECCu002dF413E455BDF7u007d/u0035727597Fu002d90A1u002d476Bu002d838Fu002d3B50A6BAB817.cs Large array initialization: .cctor: array initializer size 11605
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b2D7B5E04u002d9E20u002d4A39u002dAECCu002dF413E455BDF7u007d/u0035727597Fu002d90A1u002d476Bu002d838Fu002d3B50A6BAB817.cs Large array initialization: .cctor: array initializer size 11605
Uses 32bit PE files
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.7a40000.9.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.7a40000.9.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.10.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000000.00000002.433764816.0000000007A40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Detected potential crypto function
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 0_2_00D94714 0_2_00D94714
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 0_2_00D96CA5 0_2_00D96CA5
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_00F06CA5 1_2_00F06CA5
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_00F04714 1_2_00F04714
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0193F080 1_2_0193F080
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0193F3C8 1_2_0193F3C8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_01936120 1_2_01936120
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646B718 1_2_0646B718
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646C468 1_2_0646C468
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_06467EA2 1_2_06467EA2
Sample file is different than original file name gathered from version info
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.422511334.0000000000E44000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameBadImageFormatExcept.exe" vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.424115228.00000000031A1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBMNuHOcWjgVEWdUIjWeMzsK.exe4 vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.433764816.0000000007A40000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.423191668.00000000015BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.428041708.0000000004279000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBMNuHOcWjgVEWdUIjWeMzsK.exe4 vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.428041708.0000000004279000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIVectorView.dllN vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000000.420255488.0000000000FB4000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameBadImageFormatExcept.exe" vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000000.420640504.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameBMNuHOcWjgVEWdUIjWeMzsK.exe4 vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.645714875.00000000016BA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.645053288.0000000001358000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Binary or memory string: OriginalFilenameBadImageFormatExcept.exe" vs DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Virustotal: Detection: 32%
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe ReversingLabs: Detection: 20%
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe "C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe"
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process created: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process created: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL - OVERDUE ACCOUNT - 130115482244.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, A/F1.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\cQsBHRkRnH\src\obj\x86\Debug\BadImageFormatExcept.pdb source: DHL - OVERDUE ACCOUNT - 130115482244.exe
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_01935458 push ss; retf 5505h 1_2_0193550E
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0193ADA9 pushfd ; retf 0005h 1_2_0193ADAA
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646B660 push es; ret 1_2_0646B670
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646A609 push es; retf 1_2_0646A78C
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646A7D9 push es; retf 1_2_0646A7D8
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Code function: 1_2_0646A7D9 push es; retf 1_2_0646A824
Source: initial sample Static PE information: section name: .text entropy: 7.75351668715
Creates processes with suspicious names
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File created: \dhl - overdue account - 130115482244.exe
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File created: \dhl - overdue account - 130115482244.exe Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.424115228.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 1700, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.424115228.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.424115228.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe TID: 3108 Thread sleep time: -43731s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe TID: 5336 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe TID: 4724 Thread sleep count: 6469 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe TID: 4724 Thread sleep count: 2274 > 30 Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Window / User API: threadDelayed 6469 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Window / User API: threadDelayed 2274 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Thread delayed: delay time: 43731 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000002.646099485.0000000001751000.00000004.00000020.00020000.00000000.sdmp, DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000001.00000003.457077099.000000000177E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls gg
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: DHL - OVERDUE ACCOUNT - 130115482244.exe, 00000000.00000002.425042726.0000000003270000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Enables debug privileges
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Memory written: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Process created: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.420640504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.644568588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.419459827.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.420135063.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.418939154.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.428041708.0000000004279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 1700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 6220, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\DHL - OVERDUE ACCOUNT - 130115482244.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 6220, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.DHL - OVERDUE ACCOUNT - 130115482244.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.4279a48.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42e4488.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.DHL - OVERDUE ACCOUNT - 130115482244.exe.42afe68.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000000.420640504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.644568588.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.419459827.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.420135063.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.418939154.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.428041708.0000000004279000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.646349174.0000000003201000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 1700, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: DHL - OVERDUE ACCOUNT - 130115482244.exe PID: 6220, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.198.38
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.198.38 true