Source: |
Binary string: wntdll.pdbUGP source: DHL_67329033929228____________________________.exe, 00000000.00000003.1258174555.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, DHL_67329033929228____________________________.exe, 00000000.00000003.1257015443.0000000003B10000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: DHL_67329033929228____________________________.exe, 00000000.00000003.1258174555.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, DHL_67329033929228____________________________.exe, 00000000.00000003.1257015443.0000000003B10000.00000004.00001000.00020000.00000000.sdmp |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E24696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00E24696 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00E2F200 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00E2F35D |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00E2F65E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_00E2C9C7 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2C93C FindFirstFileW,FindClose, |
0_2_00E2C93C |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E23A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00E23A2B |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E23D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00E23D4E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00E2BF27 |
Source: RegSvcs.exe, 00000002.00000002.2499701664.0000000005790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04 |
Source: RegSvcs.exe, 00000002.00000002.2499701664.00000000057F2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06 |
Source: RegSvcs.exe, 00000002.00000002.2499701664.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.000000000580D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q |
Source: RegSvcs.exe, 00000002.00000002.2499701664.0000000005790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0 |
Source: RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://mail.worlorderbillions.top |
Source: RegSvcs.exe, 00000002.00000002.2499701664.0000000005790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.000000000580D000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ocsp.comodoca.com0 |
Source: RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://worlorderbillions.top |
Source: DHL_67329033929228____________________________.exe, 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2495105894.0000000000532000.00000040.80000000.00040000.00000000.sdmp |
String found in binary or memory: https://account.dyn.com/ |
Source: RegSvcs.exe, 00000002.00000002.2499701664.0000000005790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2499701664.00000000057B6000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://sectigo.com/CPS0 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E3425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_00E3425A |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E34458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, |
0_2_00E34458 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E3425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, |
0_2_00E3425A |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E4CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, |
0_2_00E4CDAC |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 2.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: This is a third-party compiled AutoIt script. |
0_2_00DC3B4C |
Source: DHL_67329033929228____________________________.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
|
Source: DHL_67329033929228____________________________.exe, 00000000.00000002.1273770399.0000000000E75000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_cab1ca4c-0 |
Source: DHL_67329033929228____________________________.exe, 00000000.00000002.1273770399.0000000000E75000.00000002.00000001.01000000.00000003.sdmp |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_ba3ec6ce-5 |
Source: DHL_67329033929228____________________________.exe |
String found in binary or memory: This is a third-party compiled AutoIt script. |
memstr_db75966c-6 |
Source: DHL_67329033929228____________________________.exe |
String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer |
memstr_c3f76648-b |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E18858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, |
0_2_00E18858 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DCE800 |
0_2_00DCE800 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DEDBB5 |
0_2_00DEDBB5 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E4804A |
0_2_00E4804A |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DCE060 |
0_2_00DCE060 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF7006 |
0_2_00DF7006 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD3190 |
0_2_00DD3190 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD4140 |
0_2_00DD4140 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD710E |
0_2_00DD710E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DC1287 |
0_2_00DC1287 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DEF419 |
0_2_00DEF419 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF6522 |
0_2_00DF6522 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DE16C4 |
0_2_00DE16C4 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD5680 |
0_2_00DD5680 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E40665 |
0_2_00E40665 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF267E |
0_2_00DF267E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DE78D3 |
0_2_00DE78D3 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD58C0 |
0_2_00DD58C0 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD6843 |
0_2_00DD6843 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF89DF |
0_2_00DF89DF |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E40AE2 |
0_2_00E40AE2 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF6A94 |
0_2_00DF6A94 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DD8A0E |
0_2_00DD8A0E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E1EB07 |
0_2_00E1EB07 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E28B13 |
0_2_00E28B13 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DECD61 |
0_2_00DECD61 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF9D05 |
0_2_00DF9D05 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DCFE40 |
0_2_00DCFE40 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DEBFE6 |
0_2_00DEBFE6 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00D23680 |
0_2_00D23680 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00924A98 |
2_2_00924A98 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00929B50 |
2_2_00929B50 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_0092CE90 |
2_2_0092CE90 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_00923E80 |
2_2_00923E80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_009241C8 |
2_2_009241C8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_0599A068 |
2_2_0599A068 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_0599BB58 |
2_2_0599BB58 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B56D0 |
2_2_059B56D0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B0040 |
2_2_059B0040 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059BDC8D |
2_2_059BDC8D |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059BBCF8 |
2_2_059BBCF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B3F48 |
2_2_059B3F48 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B8B80 |
2_2_059B8B80 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B2AF8 |
2_2_059B2AF8 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B9AE0 |
2_2_059B9AE0 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B3237 |
2_2_059B3237 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Code function: 2_2_059B4FF0 |
2_2_059B4FF0 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: String function: 00DE0D27 appears 70 times |
|
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: String function: 00DE8B40 appears 37 times |
|
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: String function: 00DC7F41 appears 34 times |
|
Source: DHL_67329033929228____________________________.exe, 00000000.00000003.1255513891.0000000003D8D000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_67329033929228____________________________.exe |
Source: DHL_67329033929228____________________________.exe, 00000000.00000003.1254345124.0000000003BE3000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_67329033929228____________________________.exe |
Source: DHL_67329033929228____________________________.exe, 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenameda505e73-ce6a-4c37-8e7a-d349dd39df37.exe4 vs DHL_67329033929228____________________________.exe |
Source: DHL_67329033929228____________________________.exe, 00000000.00000003.1258934272.0000000003C33000.00000004.00001000.00020000.00000000.sdmp |
Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_67329033929228____________________________.exe |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 2.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, roEs93G.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, roEs93G.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, JQn0Aia1.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, JQn0Aia1.cs |
Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, YsrmZ97b.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, YsrmZ97b.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, YsrmZ97b.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, YsrmZ97b.cs |
Cryptographic APIs: 'TransformFinalBlock' |
Source: unknown |
Process created: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe "C:\Users\user\Desktop\DHL_67329033929228____________________________.exe" |
|
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL_67329033929228____________________________.exe" |
|
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL_67329033929228____________________________.exe" |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: wsock32.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: version.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: winmm.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: mpr.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: wininet.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: iphlpapi.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: userenv.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: uxtheme.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: kernel.appcore.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: windows.storage.dll |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Section loaded: wldp.dll |
Jump to behavior |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: DHL_67329033929228____________________________.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: |
Binary string: wntdll.pdbUGP source: DHL_67329033929228____________________________.exe, 00000000.00000003.1258174555.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, DHL_67329033929228____________________________.exe, 00000000.00000003.1257015443.0000000003B10000.00000004.00001000.00020000.00000000.sdmp |
Source: |
Binary string: wntdll.pdb source: DHL_67329033929228____________________________.exe, 00000000.00000003.1258174555.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, DHL_67329033929228____________________________.exe, 00000000.00000003.1257015443.0000000003B10000.00000004.00001000.00020000.00000000.sdmp |
Source: DHL_67329033929228____________________________.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata |
Source: DHL_67329033929228____________________________.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc |
Source: DHL_67329033929228____________________________.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc |
Source: DHL_67329033929228____________________________.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata |
Source: DHL_67329033929228____________________________.exe |
Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E455FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, |
0_2_00E455FD |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DC4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, |
0_2_00DC4A35 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Process information set: NOOPENFILEERRORBOX |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E24696 GetFileAttributesW,FindFirstFileW,FindClose, |
0_2_00E24696 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00E2F200 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, |
0_2_00E2F35D |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00E2F65E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, |
0_2_00E2C9C7 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2C93C FindFirstFileW,FindClose, |
0_2_00E2C93C |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E23A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00E23A2B |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E23D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, |
0_2_00E23D4E |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E2BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, |
0_2_00E2BF27 |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 100000 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99858 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99749 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99640 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99531 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99421 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99312 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99170 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 99062 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98946 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98785 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98670 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98559 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98373 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98259 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98151 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 98046 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97937 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97828 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97718 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97606 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97500 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97390 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97281 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97171 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 97062 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96953 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96843 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96734 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96625 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96515 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96406 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96296 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96187 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 96074 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95968 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95782 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 95609 |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Thread delayed: delay time: 922337203685477 |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, |
0_2_00DF5CCC |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00D23570 mov eax, dword ptr fs:[00000030h] |
0_2_00D23570 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00D23510 mov eax, dword ptr fs:[00000030h] |
0_2_00D23510 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00D21ED0 mov eax, dword ptr fs:[00000030h] |
0_2_00D21ED0 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E181F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_00E181F7 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E181F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, |
0_2_00E181F7 |
Source: DHL_67329033929228____________________________.exe |
Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning |
Source: DHL_67329033929228____________________________.exe |
Binary or memory string: Shell_TrayWnd |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation |
Jump to behavior |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00DF418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, |
0_2_00DF418A |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.2497826249.000000000259A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2495105894.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2497826249.0000000002521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: DHL_67329033929228____________________________.exe PID: 4296, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3172, type: MEMORYSTR |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles |
Jump to behavior |
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities |
Jump to behavior |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.2495105894.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2497826249.0000000002521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: DHL_67329033929228____________________________.exe PID: 4296, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3172, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.DHL_67329033929228____________________________.exe.d30000.0.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 2.2.RegSvcs.exe.530000.0.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000002.00000002.2497826249.000000000259A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2495105894.0000000000532000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2497826249.000000000256E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.1273415604.0000000000D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000002.00000002.2497826249.0000000002521000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: DHL_67329033929228____________________________.exe PID: 4296, type: MEMORYSTR |
Source: Yara match |
File source: Process Memory Space: RegSvcs.exe PID: 3172, type: MEMORYSTR |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E36596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, |
0_2_00E36596 |
Source: C:\Users\user\Desktop\DHL_67329033929228____________________________.exe |
Code function: 0_2_00E36A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket, |
0_2_00E36A5A |