Windows Analysis Report
DHL #109#.exe

Antivirus detection for dropped file

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 1576, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\Zip.exe

Avira: detection malicious, Label: TR/Redcap.vxffz

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Zip.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: DHL #109#.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Joe Sandbox ML: detected

Source: DHL #109#.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DHL #109#.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Core.ni.pdbRSDSD source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: (Pon0C:\Windows\EOFmqeF.pdbpdbqeF.pdb6 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb03fTp source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Xml.pdb\ source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\update_230310.PDB source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\update_230310.PDBo source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: (PonPC:\Windows\System.Runtime.Remoting.pdb source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\update_230310.PDB source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\EOFmqeF.pdbE source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbMZ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Runtime.Remoting.pdbMZ@ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000484000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: Microsoft.VisualBasic.pdbSystem.Runtime.Remoting.dllSystem.Runtime.Remoting.dll source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdb`B source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: znC:\Users\user\AppData\Local\Temp\EOFmqeF.pdbosoft.VisualBasic\v4.0_10.0.0.0__b03f5fF6 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: 11d50a3a\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.590990822.000000000046A000.00000040.00000400.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000000.406009010.0000014B55368000.00000002.00000001.01000000.0000000A.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe.3.dr
Source:	Binary string: EOFmqeF.pdbOFmqeF.pdbpdbqeF.pdbEOFmqeF.pdb5563209-4053062332-1002 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\EOFmqeF.pdbhq source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: .pdby source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: (Pon0C:\Windows\EOFmqeF.pdbpdbqeF.pdb source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb0 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: EOFmqeF.pdb source: DHL #109#.exe, WER8AB0.tmp.dmp.21.dr, SDGUedyFqQlpw.exe.0.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: C:\Windows\EOFmqeF.pdbpdbqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb`B source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: znC:\Users\user\AppData\Local\Temp\EOFmqeF.pdbosoft.VisualBasic\v4.0_10.0.0.0__b03f5fF source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb6 source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Configuration.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: SDGUedyFqQlpw.exe, 00000004.00000003.486034018.0000000008FFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\System.Runtime.Remoting.pdb source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb4: source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Xml.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: o.pdb source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004201000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000461000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll0.3.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb66 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: EOFmqeF.pdbSHA256t source: DHL #109#.exe, WER8AB0.tmp.dmp.21.dr, SDGUedyFqQlpw.exe.0.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Xml.pdbH source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: mscorlib.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.pdb8) source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Drawing.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Core.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Core.pdbMZ source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: osymbols\exe\EOFmqeF.pdbE source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\EOFmqeF.pdb= source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: .pdb@ source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr

Networking

May check the online IP address of the machine

Source: C:\Users\user\Desktop\DHL #109#.exe	DNS query: name: ip-api.com
Source: C:\Users\user\Desktop\DHL #109#.exe	DNS query: name: ip-api.com
Source: C:\Users\user\Desktop\DHL #109#.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	DNS query: name: ip-api.com
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	DNS query: name: ip-api.com

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bblaccessories.com/webpanel
Source: DHL #109#.exe, 00000000.00000003.317732879.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.wikip
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000419F000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.590990822.0000000000464000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000461000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004622000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004625000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll0.3.dr	String found in binary or memory: http://expression/newtonsoft.json.dll
Source: DHL #109#.exe, 00000000.00000003.318460569.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.318382526.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: update_230310.exe, 0000000B.00000002.458348039.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.478611813.00000000026D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo.com/foo
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B5718F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571AA000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571D2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571AA000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000000.405942498.0000014B55362000.00000002.00000001.01000000.0000000A.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B57111000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571DE000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.000000000047F000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000467000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe.3.dr	String found in binary or memory: http://ip-api.com/json/
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4Dp
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4Dp8
Source: Zip.exe, 00000005.00000002.494978051.0000014B571AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com8
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.comD8Dp4
Source: Zip.exe, 00000005.00000002.494978051.0000014B5718F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.comx
Source: Newtonsoft.Json.dll0.3.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1k
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/gk
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobjk
Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B57111000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 0000000B.00000002.458348039.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.478611813.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL #109#.exe, SDGUedyFqQlpw.exe.0.dr	String found in binary or memory: http://teamwiki.de/twiki/vb_tool.php)MSXML2.ServerXMLHTTP
Source: Amcache.hve.21.dr	String found in binary or memory: http://upx.sf.net
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.321783957.0000000005A09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: DHL #109#.exe, 00000000.00000002.362907181.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commita9
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: DHL #109#.exe, 00000000.00000003.318014020.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com;
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.320597559.0000000005A11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: DHL #109#.exe, 00000000.00000003.320597559.0000000005A11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnP
Source: DHL #109#.exe, 00000000.00000003.320634552.0000000005A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnht/
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: DHL #109#.exe, 00000000.00000003.317237807.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316497484.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: DHL #109#.exe, 00000000.00000003.317779300.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317934427.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316786310.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316605273.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317654836.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316945169.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316854752.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317881321.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316636779.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316561265.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316977271.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317065111.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317237807.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com2
Source: DHL #109#.exe, 00000000.00000003.316484548.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.coml
Source: DHL #109#.exe, 00000000.00000003.316484548.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comrow
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: DHL #109#.exe, 00000000.00000003.320522721.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.320634552.0000000005A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kru
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: DHL #109#.exe, 00000000.00000003.321783957.0000000005A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnue
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B57209000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.000000000047F000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000003086000.00000004.00000800.00020000.00000000.sdmp, info.txt.3.dr	String found in binary or memory: https://gomorrah.pw
Source: DHL #109#.exe, SDGUedyFqQlpw.exe.0.dr	String found in binary or memory: https://max-weller.de
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: DHL #109#.exe, 00000000.00000002.361918826.0000000000D29000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 1576, type: MEMORYSTR

System Summary

Source: 5.0.Zip.exe.14b55360000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 26.2.SDGUedyFqQlpw.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 26.2.SDGUedyFqQlpw.exe.30aef00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 4.2.SDGUedyFqQlpw.exe.31812d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.DHL #109#.exe.28b64c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 3.2.DHL #109#.exe.2c59d24.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000003.00000002.590990822.0000000000466000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000005.00000000.405942498.0000014B55362000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Zip.exe, type: DROPPED	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 Author: unknown

.NET source code contains very large strings

Source: DHL #109#.exe, frm_options.cs	Long String: Length: 72717
Source: SDGUedyFqQlpw.exe.0.dr, frm_options.cs	Long String: Length: 72717
Source: 0.0.DHL #109#.exe.4d0000.0.unpack, frm_options.cs	Long String: Length: 72717

Source: DHL #109#.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.0.Zip.exe.14b55360000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 26.2.SDGUedyFqQlpw.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 26.2.SDGUedyFqQlpw.exe.30aef00.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 4.2.SDGUedyFqQlpw.exe.31812d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.DHL #109#.exe.28b64c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 3.2.DHL #109#.exe.2c59d24.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000003.00000002.590990822.0000000000466000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000005.00000000.405942498.0000014B55362000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\Zip.exe, type: DROPPED	Matched rule: Windows_Trojan_Lucifer_ce9d4cc8 reference_sample = 1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lucifer, fingerprint = 77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55, id = ce9d4cc8-8f16-4272-a54b-e500d4edea9b, last_modified = 2022-04-12

Source: C:\Users\user\AppData\Local\Temp\update_230310.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1432

Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 0_2_00D1C2B0	0_2_00D1C2B0
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 0_2_00D19968	0_2_00D19968
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 0_2_053E0006	0_2_053E0006
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 0_2_053E0040	0_2_053E0040
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_00E9DDE8	3_2_00E9DDE8
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_00E9DED4	3_2_00E9DED4
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_00E9DDA9	3_2_00E9DDA9
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_00E9DE28	3_2_00E9DE28
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A3B29C	3_2_02A3B29C
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A3C310	3_2_02A3C310
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A3B290	3_2_02A3B290
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A3B1F2	3_2_02A3B1F2
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A399D0	3_2_02A399D0
Source: C:\Users\user\Desktop\DHL #109#.exe	Code function: 3_2_02A3DFD0	3_2_02A3DFD0

Source: DHL #109#.exe, 00000000.00000002.399292839.0000000008CC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002914000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZip.exe( vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameupdate_windows10.exeD vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000000.310547701.00000000004D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEOFmqeF.exe6 vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEOFmqeF.exe6 vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZip.exe( vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.397532415.0000000007550000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameWinForm.dllX vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinForm.dllX vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameupdate_windows10.exeD vs DHL #109#.exe
Source: DHL #109#.exe, 00000000.00000002.361918826.0000000000D29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.590990822.000000000046A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZip.exe( vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorlib.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.DLLT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Drawing.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Core.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Xml.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Remoting.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.Extensions.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Management.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCustomMarshalers.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.590990822.0000000000486000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameupdate_windows10.exeD vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorlib.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.VisualBasic.DLLT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Drawing.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Configuration.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Core.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Xml.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Runtime.Remoting.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.Extensions.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Web.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Management.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCustomMarshalers.dllT vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.615393541.000000000413E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEOFmqeF.exe6 vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZip.exe( vs DHL #109#.exe
Source: DHL #109#.exe, 00000003.00000002.615393541.0000000003EF9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEOFmqeF.exe6 vs DHL #109#.exe
Source: DHL #109#.exe	Binary or memory string: OriginalFilenameEOFmqeF.exe6 vs DHL #109#.exe

Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Section loaded: sfc.dll

Source: DHL #109#.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SDGUedyFqQlpw.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DHL #109#.exe	ReversingLabs: Detection: 21%
Source: DHL #109#.exe	Virustotal: Detection: 37%

Source: C:\Users\user\Desktop\DHL #109#.exe

File read: C:\Users\user\Desktop\DHL #109#.exe

Source: DHL #109#.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL #109#.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\DHL #109#.exe C:\Users\user\Desktop\DHL #109#.exe
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp6F29.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\Desktop\DHL #109#.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_230310.exe "C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_230310.exe "C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_230310.exe "C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_230310.exe "C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1432
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1428
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp85AA.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe {path}
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp6F29.tmp	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\Desktop\DHL #109#.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp85AA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\DHL #109#.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Users\user\Desktop\DHL #109#.exe

File created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe

Source: C:\Users\user\Desktop\DHL #109#.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6F29.tmp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/24@8/2

Source: C:\Users\user\Desktop\DHL #109#.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: DHL #109#.exe, 00000003.00000002.601389886.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000427A000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.00000000030C7000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.00000000030BB000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000303D000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000003049000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004697000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL #109#.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\DHL #109#.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5296
Source: C:\Users\user\Desktop\DHL #109#.exe	Mutant created: \Sessions\1\BaseNamedObjects\update_windows10
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6088
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3016:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6140:120:WilError_01
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Mutant created: \Sessions\1\BaseNamedObjects\OjFUNPBNAAii

Source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: C:\Users\user\Desktop\DHL #109#.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\DHL #109#.exe	Automated click: Continue
Source: C:\Users\user\Desktop\DHL #109#.exe	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DHL #109#.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Uses schtasks.exe or at.exe to add and modify task schedules

Source: DHL #109#.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: DHL #109#.exe

Static file information: File size 1190400 > 1048576

Source: DHL #109#.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DHL #109#.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x107c00

Source: DHL #109#.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DHL #109#.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Core.ni.pdbRSDSD source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: (Pon0C:\Windows\EOFmqeF.pdbpdbqeF.pdb6 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb03fTp source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Xml.pdb\ source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\update_230310.PDB source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\update_230310.PDBo source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: (PonPC:\Windows\System.Runtime.Remoting.pdb source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\update_230310.PDB source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\EOFmqeF.pdbE source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbMZ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Runtime.Remoting.pdbMZ@ source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000484000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: Microsoft.VisualBasic.pdbSystem.Runtime.Remoting.dllSystem.Runtime.Remoting.dll source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdb`B source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: znC:\Users\user\AppData\Local\Temp\EOFmqeF.pdbosoft.VisualBasic\v4.0_10.0.0.0__b03f5fF6 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: 11d50a3a\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.590990822.000000000046A000.00000040.00000400.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000000.406009010.0000014B55368000.00000002.00000001.01000000.0000000A.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe.3.dr
Source:	Binary string: EOFmqeF.pdbOFmqeF.pdbpdbqeF.pdbEOFmqeF.pdb5563209-4053062332-1002 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\EOFmqeF.pdbhq source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: .pdby source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: (Pon0C:\Windows\EOFmqeF.pdbpdbqeF.pdb source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb0 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: EOFmqeF.pdb source: DHL #109#.exe, WER8AB0.tmp.dmp.21.dr, SDGUedyFqQlpw.exe.0.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: C:\Windows\EOFmqeF.pdbpdbqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb`B source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: znC:\Users\user\AppData\Local\Temp\EOFmqeF.pdbosoft.VisualBasic\v4.0_10.0.0.0__b03f5fF source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\EOFmqeF.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb6 source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.Remoting.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Configuration.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: SDGUedyFqQlpw.exe, 00000004.00000003.486034018.0000000008FFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: symbols\dll\System.Runtime.Remoting.pdb source: SDGUedyFqQlpw.exe, 00000004.00000002.589351882.0000000008E0C000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb4: source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Xml.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: o.pdb source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004201000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.0000000000461000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000045BE000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll.3.dr, Newtonsoft.Json.dll0.3.dr
Source:	Binary string: C:\Users\user\AppData\Local\Temp\EOFmqeF.pdb66 source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: EOFmqeF.pdbSHA256t source: DHL #109#.exe, WER8AB0.tmp.dmp.21.dr, SDGUedyFqQlpw.exe.0.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Xml.pdbH source: WERAC41.tmp.dmp.23.dr
Source:	Binary string: mscorlib.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.pdb8) source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Drawing.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Core.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: System.Core.pdbMZ source: WER8AB0.tmp.dmp.21.dr
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: osymbols\exe\EOFmqeF.pdbE source: update_230310.exe, 00000014.00000002.466841635.00000000006F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\EOFmqeF.pdb= source: update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr
Source:	Binary string: .pdb@ source: update_230310.exe, 0000000B.00000002.453692819.0000000000DD8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER8AB0.tmp.dmp.21.dr, WERAC41.tmp.dmp.23.dr

Source: C:\Users\user\Desktop\DHL #109#.exe

Code function: 3_2_02A3E672 push eax; ret

3_2_02A3E679

Source: initial sample	Static PE information: section name: .text entropy: 7.513961549932198
Source: initial sample	Static PE information: section name: .text entropy: 7.513961549932198

Source: C:\Users\user\Desktop\DHL #109#.exe	File created: C:\Users\user\Desktop\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHL #109#.exe	File created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DHL #109#.exe	File created: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DHL #109#.exe	File created: C:\Users\user\AppData\Local\Temp\Zip.exe	Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\DHL #109#.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp6F29.tmp

Source: C:\Users\user\Desktop\DHL #109#.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (31).png

Moves itself to temp directory

Source: c:\users\user\desktop\dhl #109#.exe

File moved: C:\Users\user\AppData\Local\Temp\update_230310.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR

Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DHL #109#.exe TID: 4788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe TID: 4360	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 5912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 5816	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 4852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 3996	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 3996	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe TID: 4644	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe TID: 5508	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 5100	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 5100	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe TID: 4692	Thread sleep count: 9660 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL #109#.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\Newtonsoft.Json.dll			Jump to dropped file
Source: C:\Users\user\Desktop\DHL #109#.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll			Jump to dropped file

Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\DHL #109#.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\DHL #109#.exe	Window / User API: threadDelayed 9615	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Window / User API: threadDelayed 9682
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Window / User API: threadDelayed 9660

Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Users\user\Desktop\DHL #109#.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.598530994.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllg
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.me
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DHL #109#.exe, 00000000.00000002.362584894.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}q
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: DHL #109#.exe, 00000000.00000002.361918826.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{[
Source: DHL #109#.exe, 00000000.00000002.361918826.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.526108699.000000000164F000.00000004.00000020.00020000.00000000.sdmp, update_230310.exe, 0000000B.00000002.455230591.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1g
Source: Amcache.hve.21.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.21.dr	Binary or memory string: VMware-42 35 bb 32 33 75 d2 27-52 00 3c e2 4b d4 32 71
Source: Zip.exe, 00000005.00000002.492612721.0000014B5552C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Users\user\Desktop\DHL #109#.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\DHL #109#.exe

Memory allocated: page read and write | page guard

Injects a PE file into a foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\DHL #109#.exe	Memory written: C:\Users\user\Desktop\DHL #109#.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Memory written: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp6F29.tmp	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\Desktop\DHL #109#.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp85AA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Process created: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Users\user\Desktop\DHL #109#.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Users\user\Desktop\DHL #109#.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Zip.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_230310.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_230310.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_230310.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Users\user\Desktop\DHL #109#.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\DHL #109#.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: Amcache.hve.21.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: SDGUedyFqQlpw.exe, 0000001A.00000002.598530994.00000000013D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 1576, type: MEMORYSTR

Source: C:\Users\user\Desktop\DHL #109#.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\DHL #109#.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.601389886.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 1576, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 0.2.DHL #109#.exe.3a8ba10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3dbac13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3c97ff0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a27b28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3a2812b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL #109#.exe.3be9bd0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558810.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.44aa3f0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SDGUedyFqQlpw.exe.4558e13.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DHL #109#.exe PID: 4016, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: SDGUedyFqQlpw.exe PID: 1576, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	2 Obfuscated Files or Information	1 Input Capture	23 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	21 Masquerading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL #109#.exe	21%	ReversingLabs	Win32.Trojan.Pwsx
DHL #109#.exe	37%	Virustotal		Browse
DHL #109#.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Zip.exe	100%	Avira	TR/Redcap.vxffz
C:\Users\user\AppData\Local\Temp\Zip.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Zip.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.Oskistelaer
C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe	21%	ReversingLabs	Win32.Trojan.Pwsx
C:\Users\user\Desktop\Newtonsoft.Json.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.zhongyicts.com.cnue	0%	URL Reputation	safe
http://www.founder.com.cn/cnP	0%	URL Reputation	safe
http://www.founder.com.cn/cnP	0%	URL Reputation	safe
http://www.sajatypeworks.com2	0%	URL Reputation	safe
http://www.sajatypeworks.com2	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.carterandcone.comC	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://ip-api.com4Dp8	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sajatypeworks.coml	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://www.carterandcone.comTC	0%	URL Reputation	safe
http://bblaccessories.com/webpanel	100%	Avira URL Cloud	malware
http://en.wikip	0%	URL Reputation	safe
http://ip-api.comx	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://ns.ado/1	0%	URL Reputation	safe
http://www.sajatypeworks.comrow	0%	Avira URL Cloud	safe
http://ns.adobe.c/gk	0%	Avira URL Cloud	safe
http://ip-api.com8	0%	Avira URL Cloud	safe
http://ns.adobe.cobjk	0%	Avira URL Cloud	safe
https://gomorrah.pw	0%	Avira URL Cloud	safe
http://ip-api.comD8Dp4	0%	Avira URL Cloud	safe
http://teamwiki.de/twiki/vb_tool.php)MSXML2.ServerXMLHTTP	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnht/	0%	Avira URL Cloud	safe
http://www.sandoll.co.kru	0%	Avira URL Cloud	safe
http://foo.com/foo	0%	Avira URL Cloud	safe
https://max-weller.de	0%	Avira URL Cloud	safe
http://ns.ado/1k	0%	Avira URL Cloud	safe
http://www.fonts.com;	0%	Avira URL Cloud	safe
http://ip-api.com4Dp	0%	Avira URL Cloud	safe
http://www.fontbureau.commita9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.zhongyicts.com.cnue	DHL #109#.exe, 00000000.00000003.321783957.0000000005A0F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnP	DHL #109#.exe, 00000000.00000003.320597559.0000000005A11000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com2	DHL #109#.exe, 00000000.00000003.317779300.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317934427.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316786310.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316605273.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317654836.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316945169.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316854752.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317881321.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316636779.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316561265.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316977271.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317065111.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.317237807.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.comrow	DHL #109#.exe, 00000000.00000003.316484548.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.c/g	SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com8	Zip.exe, 00000005.00000002.494978051.0000014B571AA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com4Dp8	DHL #109#.exe, 00000003.00000002.601389886.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	DHL #109#.exe, 00000000.00000003.317237807.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.316497484.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	DHL #109#.exe, 00000000.00000003.318460569.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.318382526.0000000005A3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bblaccessories.com/webpanel	SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://ns.adobe.c/gk	DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comC	DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	DHL #109#.exe, 00000003.00000002.601389886.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B5718F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571AA000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571D2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.cobjk	DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://teamwiki.de/twiki/vb_tool.php)MSXML2.ServerXMLHTTP	DHL #109#.exe, SDGUedyFqQlpw.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DHL #109#.exe, 00000000.00000002.363079133.0000000002881000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.529662640.0000000003141000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B57111000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 0000000B.00000002.458348039.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.478611813.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gomorrah.pw	DHL #109#.exe, 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002BB3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C3B000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B57209000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.590897146.000000000047F000.00000040.00000400.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000003086000.00000004.00000800.00020000.00000000.sdmp, info.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://ip-api.comD8Dp4	DHL #109#.exe, 00000003.00000002.601389886.0000000002FFA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.coml	DHL #109#.exe, 00000000.00000003.316484548.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.321783957.0000000005A09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnht/	DHL #109#.exe, 00000000.00000003.320634552.0000000005A03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kru	DHL #109#.exe, 00000000.00000003.320522721.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.320634552.0000000005A03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.cobj	SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comTC	DHL #109#.exe, 00000000.00000003.323381300.0000000005A04000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.322676068.0000000005A02000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.323305799.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.21.dr	false		high
https://max-weller.de	DHL #109#.exe, SDGUedyFqQlpw.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://en.wikip	DHL #109#.exe, 00000000.00000003.317732879.0000000005A02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	DHL #109#.exe, 00000003.00000002.615393541.0000000004375000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042EB000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004792000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.comx	Zip.exe, 00000005.00000002.494978051.0000014B5718F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000005.00000002.494978051.0000014B571DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll0.3.dr	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://foo.com/foo	update_230310.exe, 0000000B.00000002.458348039.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_230310.exe, 00000014.00000002.478611813.00000000026D3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfp	DHL #109#.exe, 00000003.00000002.615393541.000000000434D000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.00000000042C3000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004392000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000002.615393541.0000000004308000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004725000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.00000000046E0000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp, DHL #109#.exe, 00000000.00000003.320597559.0000000005A11000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	DHL #109#.exe, 00000000.00000002.394100205.0000000006C12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.ado/1k	DHL #109#.exe, 00000003.00000002.647285236.000000000788C000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.438266278.000000000788F000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.400369407.000000000787B000.00000004.00000020.00020000.00000000.sdmp, DHL #109#.exe, 00000003.00000003.437944666.0000000007891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com4Dp	SDGUedyFqQlpw.exe, 0000001A.00000002.603205973.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.000000000476A000.00000004.00000800.00020000.00000000.sdmp, SDGUedyFqQlpw.exe, 0000001A.00000002.617237833.0000000004708000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com;	DHL #109#.exe, 00000000.00000003.318014020.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://ns.ado/1	SDGUedyFqQlpw.exe, 0000001A.00000002.645437394.000000000798A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commita9	DHL #109#.exe, 00000000.00000002.362907181.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	798306
Start date and time:	2023-02-03 22:38:29 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	DHL #109#.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/24@8/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 60 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 104.208.16.94
Excluded domains from analysis (whitelisted): login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:39:44	API Interceptor	503x Sleep call for process: DHL #109#.exe modified
22:39:53	Task Scheduler	Run new task: SDGUedyFqQlpw path: C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
22:40:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_230310.exe / start
22:40:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_230310.exe / start
22:40:21	API Interceptor	92x Sleep call for process: Zip.exe modified
22:40:36	API Interceptor	2x Sleep call for process: WerFault.exe modified
22:40:54	API Interceptor	119x Sleep call for process: SDGUedyFqQlpw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
208.95.112.1	RePhjnSrvX	Get hash	malicious	Browse	www.ip-api.com/json
	receipt.html	Get hash	malicious	Browse	ip-api.com/json
	B96DF0C566DAA119AF3ABD0AF7C0221689F411678DA92.exe	Get hash	malicious	Browse	ip-api.com/line/?fields=hosting
	g8w7YHHUDJ	Get hash	malicious	Browse	ip-api.com/json/
	Spe00002.js	Get hash	malicious	Browse	ip-api.com/json/
	Odeme.exe	Get hash	malicious	Browse	ip-api.com/json/
	newsoftware-tester.exe	Get hash	malicious	Browse	ip-api.com/json
	uA17g37mtt.exe	Get hash	malicious	Browse	ip-api.com/json/
	Odeme.exe	Get hash	malicious	Browse	ip-api.com/json/
	VoiceNote.htm	Get hash	malicious	Browse	ip-api.com/json
	file.exe	Get hash	malicious	Browse	ip-api.com/json/
	OukBj2y5jY.exe	Get hash	malicious	Browse	ip-api.com/json/
	Spec002.js	Get hash	malicious	Browse	ip-api.com/json/
	android.apk	Get hash	malicious	Browse	www.ip-api.com/json
	FJsd1qxDgJ.exe	Get hash	malicious	Browse	ip-api.com/json/
	LhWQCnZEr8.exe	Get hash	malicious	Browse	ip-api.com/json/
	Comprobant.xls	Get hash	malicious	Browse	ip-api.com/json/
	jwlIVLR3d6.exe	Get hash	malicious	Browse	ip-api.com/json/
	Odeme.xls	Get hash	malicious	Browse	ip-api.com/json/
	Comprobante.xls	Get hash	malicious	Browse	ip-api.com/json/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ip-api.com	receipt.html	Get hash	malicious	Browse	208.95.112.1
	B96DF0C566DAA119AF3ABD0AF7C0221689F411678DA92.exe	Get hash	malicious	Browse	208.95.112.1
	g8w7YHHUDJ	Get hash	malicious	Browse	208.95.112.1
	Executed Contract.js	Get hash	malicious	Browse	208.95.112.1
	Spe00002.js	Get hash	malicious	Browse	208.95.112.1
	Odeme.exe	Get hash	malicious	Browse	208.95.112.1
	newsoftware-tester.exe	Get hash	malicious	Browse	208.95.112.1
	uA17g37mtt.exe	Get hash	malicious	Browse	208.95.112.1
	Odeme.exe	Get hash	malicious	Browse	208.95.112.1
	VoiceNote.htm	Get hash	malicious	Browse	208.95.112.1
	A3F0B643265E9895B3291658516CE2B34EB06D585BD8E.exe	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1
	unknowStealer.bin.exe	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1
	OukBj2y5jY.exe	Get hash	malicious	Browse	208.95.112.1
	Spec002.js	Get hash	malicious	Browse	208.95.112.1
	FJsd1qxDgJ.exe	Get hash	malicious	Browse	208.95.112.1
	LhWQCnZEr8.exe	Get hash	malicious	Browse	208.95.112.1
	Comprobant.xls	Get hash	malicious	Browse	208.95.112.1
	jwlIVLR3d6.exe	Get hash	malicious	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TUT-ASUS	sCv8I1z72W.exe	Get hash	malicious	Browse	208.95.112.1
	RePhjnSrvX	Get hash	malicious	Browse	208.95.112.1
	receipt.html	Get hash	malicious	Browse	208.95.112.1
	B96DF0C566DAA119AF3ABD0AF7C0221689F411678DA92.exe	Get hash	malicious	Browse	208.95.112.1
	g8w7YHHUDJ	Get hash	malicious	Browse	208.95.112.1
	Executed Contract.js	Get hash	malicious	Browse	208.95.112.1
	Spe00002.js	Get hash	malicious	Browse	208.95.112.1
	Odeme.exe	Get hash	malicious	Browse	208.95.112.1
	newsoftware-tester.exe	Get hash	malicious	Browse	208.95.112.1
	uA17g37mtt.exe	Get hash	malicious	Browse	208.95.112.1
	oZBBHsLv19.exe	Get hash	malicious	Browse	208.95.112.1
	Odeme.exe	Get hash	malicious	Browse	208.95.112.1
	VoiceNote.htm	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1
	A3F0B643265E9895B3291658516CE2B34EB06D585BD8E.exe	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1
	Payoff Statement.html	Get hash	malicious	Browse	208.95.112.1
	unknowStealer.bin.exe	Get hash	malicious	Browse	208.95.112.1
	file.exe	Get hash	malicious	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	5VXh2VBmA0.exe	Get hash	malicious	Browse
	nwY3YpWQVx.exe	Get hash	malicious	Browse
	5SUx8Md4kq.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	NicDx0BvqP.exe	Get hash	malicious	Browse
	ngyoL1siem.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.ShellCode.69.5295.22971.rtf	Get hash	malicious	Browse
	AvtoKomander_Installer.msi	Get hash	malicious	Browse
	VFMPwzPWjM.exe	Get hash	malicious	Browse
	CpLGtq4jBl.exe	Get hash	malicious	Browse
	CpLGtq4jBl.exe	Get hash	malicious	Browse
	5Qg0FFYoQd.exe	Get hash	malicious	Browse
	IBK_Minervasoft.exe	Get hash	malicious	Browse
	PO BNB Trends.exe	Get hash	malicious	Browse
	Bm6U0Vj6pa.exe	Get hash	malicious	Browse
	NEW REQUIREMENT..xlsx	Get hash	malicious	Browse
	kKEMJQNDL.exe	Get hash	malicious	Browse
	doc2022020909100101019.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_update_230310.ex_2b79ce248a0695308731c52393aacd67e8ae79_c8dd24a1_118fa089\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.18353028152947
Encrypted:	false
SSDEEP:	192:C3+JWbJ6HBUZMXSa6nzCGgiF/u7sGS274ItU:U+obsBUZMXSaM+w/u7sGX4ItU
MD5:	1F3E75B88B5D5008732C40C453A08200
SHA1:	3EA843D71FC0D0881D0AAF0C149A4C9CFBA648EA
SHA-256:	3503E67B6BB4818E49B1839F7BD5FEAD9794DC9345F78ED9D198590864AFF411
SHA-512:	09EBEBED4649C053A2A5E5D26538B9C33FE6860CF08572FDDE87D974F171E036C7245B3A10909A71A7176E27946D02BB49529F9133531235E2EC2164BC6B40D1
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.9.9.6.6.4.3.0.8.0.8.4.0.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.9.9.6.6.4.3.3.7.1.4.6.5.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.a.b.8.0.5.f.-.2.7.9.f.-.4.8.c.a.-.8.9.0.e.-.c.1.6.8.d.a.4.b.a.4.7.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.e.c.4.5.a.4.-.a.9.7.1.-.4.b.7.0.-.9.6.c.4.-.c.1.1.e.1.0.2.6.d.f.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.p.d.a.t.e._.2.3.0.3.1.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.O.F.m.q.e.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.c.8.-.0.0.0.1.-.0.0.1.9.-.5.9.e.3.-.e.4.8.a.6.3.3.8.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.2.7.0.c.b.c.8.0.9.d.c.e.0.d.6.5.6.a.d.5.d.8.b.8.1.f.2.d.5.1.5.0.0.0.0.0.0.0.0.!.0.0.0.0.5.7.8.4.7.e.1.4.c.4.e.9.b.3.d.1.1.d.0.3.b.e.c.9.6.9.b.1.c.7.9.c.3.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_update_230310.ex_2b79ce248a0695308731c52393aacd67e8ae79_c8dd24a1_1663b8b5\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.183594634047425
Encrypted:	false
SSDEEP:	192:4lCkrJ6HBUZMXSa6nzCGgiF/u7sGS274ItU:gCkrsBUZMXSaM+w/u7sGX4ItU
MD5:	188685220A48F811753BE5136C3FF079
SHA1:	3524EC2572B3C0188DFE9122F96B6269E5070B12
SHA-256:	B7A2365FD4A2ED367580CBBB33563B53F23B54326E251AA78C721E6C597F7E90
SHA-512:	C1D62DA5EAB1A9C58A2075A6810B0371C4F0476534039AB4F64891D7F117C5F7C705E004C9DBB3B083DECD5451CCD45A0701B7FF001CF68A29DC11C572B73CB7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.9.9.6.6.4.3.9.4.0.3.2.8.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.9.9.6.6.4.4.1.6.5.3.2.8.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.1.c.7.8.3.a.-.5.0.4.2.-.4.2.4.6.-.9.4.e.7.-.2.a.f.b.4.9.3.f.9.a.5.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.5.d.1.1.3.1.-.5.6.e.0.-.4.c.d.8.-.9.2.b.6.-.3.8.d.d.d.3.2.8.0.e.2.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.p.d.a.t.e._.2.3.0.3.1.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.O.F.m.q.e.F...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.b.0.-.0.0.0.1.-.0.0.1.9.-.0.9.2.7.-.5.6.9.2.6.3.3.8.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.2.7.0.c.b.c.8.0.9.d.c.e.0.d.6.5.6.a.d.5.d.8.b.8.1.f.2.d.5.1.5.0.0.0.0.0.0.0.0.!.0.0.0.0.5.7.8.4.7.e.1.4.c.4.e.9.b.3.d.1.1.d.0.3.b.e.c.9.6.9.b.1.c.7.9.c.3.4.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AB0.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Feb 4 06:40:32 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	292439
Entropy (8bit):	3.9827295135657454
Encrypted:	false
SSDEEP:	3072:XNCbSiJa0Q+Djd+pAXz0tpUCgUdo/9gIOgF5gklTZaLwL1DEeATX:Xk7I0R8peITjdq9RpDHlT0
MD5:	42750981A58B2355EFF00820C7F52D02
SHA1:	F50B48EDA950E5E799ADF0B1407516BF4768337E
SHA-256:	C6DC01746FC4CB2C220A20E6822A3E778AD98DD725C6874C854907E21C422553
SHA-512:	D9A1465C5E29739327EF10E7F9D95A8DD0CE45EBAB66E402159E870F5D32721036912C3A03789F788E861A64306608B1C2A363C1156D4D1B2565D72205646A70
Malicious:	false
Preview:	MDMP....... ..........c............D...............L.......4...\|V..........T.......8...........T............9..w<..........D'..........0)...................................................................U...........B.......)......GenuineIntelW...........T..............c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER91F4.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.698969968755615
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiaw6P6YBS85SUD8gmfZv/ScCprn89bUUsfHcm:RrlsNi16P6YBh5SUYgmfh/ScUHfJ
MD5:	42CE7C4EFF8D7CB3C065567DAA2424DB
SHA1:	A34A1BBDBA064117F9541ED7C04997FF3AEBB91F
SHA-256:	6D0497A85160ED5752F4BD213602EC24B73AC23F81F884397308F319C2BE64FB
SHA-512:	B2039427F23430EF87922307184313977B4B2D53ACA9D527E122537CE543135FA9D012852FEEAFF5402A30D2AA3DC4B84A50AD6A8E3E099587329E2ADDB46C15
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.8.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9282.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4797
Entropy (8bit):	4.5202085953390485
Encrypted:	false
SSDEEP:	48:cvIwSD8zstJgtWI9txWgc8sqYj+a8fm8M4J7N9NF/m+q8vWN9+60Zoz43d:uITfHeggrsqY6vJ7nnmKWn+6keYd
MD5:	6C2C84194B25D3F8D5EDF38485F78033
SHA1:	5B3B658E898DEE8E4A8482FA97BA4D240E138410
SHA-256:	B4653F69C94482E6B90B9FE905A61502E29380FC3E04A6CE41CC5D03AFC9548B
SHA-512:	D4AFF393212DB87728E1598C99CA2C8EBF5CAF68901A34EEC93A22134944D5BE73BDF00A8F3C69A895A227C9D93224190B376492723A572E23CE25F38AB3752E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1897431" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC41.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Feb 4 06:40:40 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	268491
Entropy (8bit):	4.130660801750376
Encrypted:	false
SSDEEP:	3072:z036jkJbf0M3RSjd+pFH9E0wYUCgUJVoz9gIOgF5XLTZaLvIwlcg9sDovo:z0Kjq0GBpFmiTjJVS9RpD7T0Ug9M
MD5:	CB2C44A20EF4FF02688B2864B9CB9D12
SHA1:	BF1999DB9F8CA467AEB26665AE78EA6D2D4734D8
SHA-256:	D2F8B27804513EE363845AFCA2F13E9D99B9A6203B3CC666E9C9014F90CC8DA4
SHA-512:	3FDEFEAA7421B2F6241684126383CFB1233F5C41DAB31D4C75E3BE0FE6B1249BE904EA0097B995595775AFAB38489A59F7433B481F63F94D87516F06DCFA21F9
Malicious:	false
Preview:	MDMP....... ..........c....................................t....M..........T.......8...........T...........(8...............&...........(...................................................................U...........B......8)......GenuineIntelW...........T..............c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB115.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.6987901348327203
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNikC6f6YBSzSUcg3gmfZv/ScCprD89bRxsfL7m:RrlsNi56f6YBWSUDgmfh/SQRqfW
MD5:	77C7BFD43FC73D82E709ABCFF8FED8F6
SHA1:	37932C050BAB36CE323A8EE851A0E4E04E9518F7
SHA-256:	A18B8B65A1637BF215F59301EFB9426E69C5D4C4A721A84F01F37CC7EEDDA7E5
SHA-512:	E1BBEA3CEFCE002BEE3CD63D3BEB544047C4D9EFEF00709DEF3069883F5E5E85D269DF9B2A31C55ACD3CCBF0344539B0CA041B9262A506E86EF77B3A9FC1C3DD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.9.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1B2.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4797
Entropy (8bit):	4.5207055282802555
Encrypted:	false
SSDEEP:	48:cvIwSD8zstJgtWI9txWgc8sqYjF8fm8M4J7N9NFxg+q8vWN9cO0ZozV3d:uITfHeggrsqYmJ7nCKWnTkeRd
MD5:	CB10FD2C3C16D7E9D05FC3C0FD61B84F
SHA1:	3D57BB6D0875433C20E2AB659F5DFCAFBD5961E4
SHA-256:	08F95AD6D690AC29E8AE207D307F2569A9D7C08161F05954ED12916EA6956D79
SHA-512:	EA983CBA9E83C45C22D31AF318EB1137981506F563C6745FD9C19CD2FA8B445E037FB4D40C256BB3BC65FCCD3240667E703EE3A02AB8A20412F153A6E948A56F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1897431" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zip.exe.log

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2343
Entropy (8bit):	5.374204171243879
Encrypted:	false
SSDEEP:	48:MxHKEYHKGD8Ao6+vxpNl1qHGiD0HKeGitHTG1hAHKKPJAmHKoAPHZHpH+5HK+HKs:iqEYqGgAo9ZPlwmI0qertzG1eqKPJ/qo
MD5:	3F114A073575263E59307B55548FD5F4
SHA1:	971459D541646C4C6B382F06AAFA9F4147716568
SHA-256:	2417EC96E49CF7352D91892438478E961D8DC870FEB8E8821C732383CD9351F2
SHA-512:	EA7B613DF726F230ADFEF841E4C8A753228B3AFAE7F2D2FDC2704892910F18254F2D9B31AA5E7D4C993137BCAE92B0FF77D9D31503E96D605DBF0589E42AD809
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_6

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL #109#.exe.log

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SDGUedyFqQlpw.exe.log

Process:	C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\CH_8D0105CC62.zip

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	817975
Entropy (8bit):	7.997768463518498
Encrypted:	true
SSDEEP:	24576:qI63AtVt9amCED55Z8yayb484d6FO+rbHGt:qI6Qj+mtnOeb4fd6E+rbGt
MD5:	546E5255876D30DECB6631CFA3DDE59A
SHA1:	E68D00F710FAF7F204D4B87D6959AA82B096338A
SHA-256:	B4709E548E950D539DE83060D75A05A95755B64F5705EDC0684798A8E2004DA6
SHA-512:	94FC4F7F2D2B4894E242D51A90091AA028AF5507C2CF2FC099745FD8CCA829B5DCC4E6DBF94996FE320C450339A0BC0DD94B128DBAE58A5ABEBC330A926E9FB8
Malicious:	false
Preview:	PK..........CV................Cards.txtPK..........CV................Files\PK..........CV...^....L.......info.txt...N.0.EwK..;&.i(m.:..0.D.....p...4._...:..{.zu....K....'VA...G......v....m..q..f'....../.k.pCG......iP.D.s.....w..G..$...cJ^.t..~.b...4...>\|KQQ.xD._Ui.,..Z............G...Q.iF..........;.....G..PK..........CV................Passwords.txtPK..........CV.9......=2......ProgramList.txt.[.r.6..g&.=.s.C..o.O...Dc.i....h(B.I.y..r....5......):1YZ.....!.....`w....XEa.t.^.3...../b.....3....'o.I........N.u\|R.:I.,.c9AGa&.?..@.S.}"....>:U...f..t."..FOeZ..1..yj....oT.....=+.g.LNT..5.p.K.s-.].....a.c...A^...M.,...<.}....c.`.v....`A.............1.4Mt.:. .z.N.k.v..a...~.Z..d....lB......\|>).@......-..!...J[<...g... .....^I.u..cb.g.".....`.aD\|M?.D....q....%.....R.....t.T.....=..-2.QnT..V..6...X...\|..qE.w..{.*C..ooG..H..=B...q...$ .v.V.....9 .......\|.....I}....#......2...C.^..VIVC.....T....M....r.C.j......}pP ...k.z..}./~..J......V...+.....WJ....

C:\Users\user\AppData\Local\Temp\CH_8D0105CC62\ProgramList.txt

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	12861
Entropy (8bit):	5.146432365744317
Encrypted:	false
SSDEEP:	96:xwI1IzJ0Npt0KY0DpaS0dVSWI8VIu5fKM0Aoc9OGObO0OROZO99OXcgc0cAO7cDk:aq0R0zU/QVWB
MD5:	8EE4E55FCF30BE8A76950F6F520204F6
SHA1:	46F5E3DB3B5E93699735411382E396AA7365BE9D
SHA-256:	970BD559D3828648528EF99AFC845069153123289C9A20E3B6E57EA4BF2CFC6C
SHA-512:	7679C52085223EE619EF85F4249EF2F55B802C6390181104816C6CFCC6F0F421210E6E6D2609324740158726522FF2A5A1B9B16A7ECDDF01A74D528B7638BD8D
Malicious:	false
Preview:	Application Name : Google.Chrome....Version : 104.0.5112.81....Installed Date . 20220816....Application Name: Microsoft Office Professional Plus 2016....Application Name: Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501....Application Name : Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005....Version : 12.0.21005....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319....Version : 10.0.30319....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Java 8 Update 211....Version : 8.0.2110.12....Installed Date . 20190627....Application Name: Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030....Application Name: Microsoft Visu

C:\Users\user\AppData\Local\Temp\CH_8D0105CC62\ProsessList.txt

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2341
Entropy (8bit):	4.574990009499718
Encrypted:	false
SSDEEP:	12:jXRoqqqqq1gMqE69YKtMqqqIuqcqIEj9+uqqqqgpyqIEEuMJqqqqqEh8MVqA8YIJ:p0Obllar//R
MD5:	4B319E2F175D3796C41C9A6E79284839
SHA1:	1489DD7FE599B1EA0737494C57AFAB6A6A48BF40
SHA-256:	3B03FF5394F777A15695209BF06D59F2BB2C8E1149508C41474F256C94E52646
SHA-512:	0AF92B36A099C6BD0B8B658E6CBE86596CA7756BA53EC5216D1F5C801BD3309C110D4BF9151EB3DCEB2B1A8CBD6CFFFB807D3B71482DCED7D28DCEDE3251D429
Malicious:	false
Preview:	Name : dwm....Name : csrss....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Name : SgrmBroker....Name : svchost....Name : svchost....Name : fontdrvhost....Name : dllhost....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : explorer....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : svchost....Name : svchost....Name : winlogon....Name : svchost....Name : svchost....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : dllhost....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : WMIADAP....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Name : spoolsv....Name : svchost....Name : svchost....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : MdNhpqxLuQeSsOdIjuQeolS....Name : svchost....Name : smartscreen....Name : svchost....Name : svchost....Name : svchost....Name : svchost....Nam

C:\Users\user\AppData\Local\Temp\CH_8D0105CC62\Screenshot.png

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	831033
Entropy (8bit):	7.948252649493437
Encrypted:	false
SSDEEP:	12288:F6A9sFCo4BIclmyLKdhIg4/nGtDcbfvu8peX0TjI+Z8l1lvB4AZbK3yMNmCp5V4U:w4BNudK1nkcbfXTvZ8lPJdiz+kqT6f
MD5:	5263177D47472A0A1C2040B1FEA1ECD3
SHA1:	D42E84E519B80025F3F40AEA4A12E18F2BCC6A8F
SHA-256:	DDC25F319860878CA034BE23086EE4934128FF82963B9FABEB70B74DBA5D497F
SHA-512:	F769D15190E617EC4E5580FF53092066D0AA3EB52F38A57817687F624DA7A4BF4972BE85AE5ADC6EF0BC8F263B8EEFEDC54E6887E65582665F130609144DA4E7
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...dGu..=.^L.Q9...M6.V.a..&/k...^l......`L...F..,!$..J(....AHBy.Fi4I....P[..=...W.......}...+.:..u..,..yf......f../t.l..5..d.f/.....el...-^..`..^Q.u..W...U![....Q....![....~..?<..x..m.......h.\..m{."l.\..F..g..c..e.)6.r.P....s..Au.df.z....kT...+.lDu..e......+=.M....yfvc.....X..g.....F...~#E..0..; ..<."4.S..l.B.}Ot./..N...Q..Q..............(.`O...`Y...M......c.W8.=...f....,....D..5M....f.3.w...f.m_..._...u.,\|.....4..h....[1.K..b0W".;.9......x.w./`-....m.g.\|....?....E..n....l.b.......X..4...@....c.Va....g.6....c..l.j;O...n..2......i[P..(,........./.a.{0&[.8.!..h..#.... ..,...-~.3...R.eJ..r0.1....T..S....M. ........8..m:...C..).).M...S.p,@.....{bh.P.>5S.0.T..A._.S..7....,..Fp.....P.#...Y.....kx@-l.>.+....@mM..-....}R....Pm.I.U...[.VF~9t..50m.j{..E...a..`.`...\|...?...K..(...K...E.6w.4.."l.HP....h....r.#t.p..A..@OT.dT..9..".N~..52.F....c.r..\|$..1P\|

C:\Users\user\AppData\Local\Temp\CH_8D0105CC62\info.txt

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.579461777700594
Encrypted:	false
SSDEEP:	6:9lngeX9CF2Rpj1hx0+A7JRXWQuGsLf15Ro1WcEuo8T:fdgIpxXKRXWQzsLN5RJcfV
MD5:	641D8C809588E0857309CBD76FDB74E8
SHA1:	17D4040422B18E3E7A3420F911D608A02D793106
SHA-256:	F58EA23262A16CB3BD55F3BF9C1E8315BA7512AD507AB74DE53272005DD52961
SHA-512:	6CD48E0176DA47E3221D3BC0D43BC05116F95B616A8D18CB6ECFC8986CC9A0830ED9A2652D320C762D43DB0AB447B57FAD515C75BB5654623CCE1DAA8D10F0FD
Malicious:	false
Preview:	PC Name : 585948..Operating System : Microsoft Windows 10 Pro..Anti virus : Windows Defender..Firewall : None..Processor : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..Memory (RAM) : 8.00 GB..-----------------------------------------------------------------------..-------------Developed By th3darkly [ https://gomorrah.pw ]-------------

C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5VXh2VBmA0.exe, Detection: malicious, Browse Filename: nwY3YpWQVx.exe, Detection: malicious, Browse Filename: 5SUx8Md4kq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NicDx0BvqP.exe, Detection: malicious, Browse Filename: ngyoL1siem.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Exploit.ShellCode.69.5295.22971.rtf, Detection: malicious, Browse Filename: AvtoKomander_Installer.msi, Detection: malicious, Browse Filename: VFMPwzPWjM.exe, Detection: malicious, Browse Filename: CpLGtq4jBl.exe, Detection: malicious, Browse Filename: CpLGtq4jBl.exe, Detection: malicious, Browse Filename: 5Qg0FFYoQd.exe, Detection: malicious, Browse Filename: IBK_Minervasoft.exe, Detection: malicious, Browse Filename: PO BNB Trends.exe, Detection: malicious, Browse Filename: Bm6U0Vj6pa.exe, Detection: malicious, Browse Filename: NEW REQUIREMENT..xlsx, Detection: malicious, Browse Filename: kKEMJQNDL.exe, Detection: malicious, Browse Filename: doc2022020909100101019.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Users\user\AppData\Local\Temp\Zip.exe

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.050531187823917
Encrypted:	false
SSDEEP:	384:KfkVQ748aUKN6C8/3g2L4QDL0Lk24jXPlfLoem/xYUIoPBsNJc:RW7PTKF8fPdDL42XPUIc
MD5:	AF07E88EC22CC90CEBFDA29517F101B9
SHA1:	A9E6F4AE24ABF76966D7DB03AF9C802E83760143
SHA-256:	1632FBFF8EDC50F2C7EF7BB2FE9B2C17E6472094F0D365A98E0DEC2A12FA8EC2
SHA-512:	B4575AF98071FC8D46C022E24BFB2C1567D7E5F3DE0D8FB5FEE6F876985C7780A5B145F645725FF27A15367162AA08490AC2F8DD59D705663094FE4E1EEEC7BC
Malicious:	true
Yara Hits:	Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Zip.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................D...6.......c... ........@.. ....................................`..................................b..K........1........................................................................... ............... ..H............text....C... ...D.................. ..`.sdata..8............H..............@....rsrc....1.......2...J..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6F29.tmp

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.179538546765989
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBpLtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3l
MD5:	0EA7371BC4169EDB1BFDBB343B9F9B8B
SHA1:	85076F6A6DE5E55E0243E302544D4E4AB4C4CE35
SHA-256:	ED2EEFE497AAED956136D2A8E6487A947DF00EFABBEA7EBC010EE65B9ADBD5AD
SHA-512:	0CCC4104DA6CB7B9A6F5E1BAFD3809E73DB0B6DA6B2D98AE65D4025128A2944648E12756183F71C732E870BD91835311EF30529110BBCD77B143E911CCBD52D0
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmp85AA.tmp

Process:	C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.179538546765989
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBpLtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3l
MD5:	0EA7371BC4169EDB1BFDBB343B9F9B8B
SHA1:	85076F6A6DE5E55E0243E302544D4E4AB4C4CE35
SHA-256:	ED2EEFE497AAED956136D2A8E6487A947DF00EFABBEA7EBC010EE65B9ADBD5AD
SHA-512:	0CCC4104DA6CB7B9A6F5E1BAFD3809E73DB0B6DA6B2D98AE65D4025128A2944648E12756183F71C732E870BD91835311EF30529110BBCD77B143E911CCBD52D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1190400
Entropy (8bit):	7.367544982340551
Encrypted:	false
SSDEEP:	24576:AlGce7MTyPdLX2tuCAe/ZX81MjOxltKwJRWDnFeoS0EnTojbFA4Pdox/O:7GjKrJEFTEnTaFxoF
MD5:	EB529EFE16B4F7171FC8C4E132CE0C60
SHA1:	57847E14C4E9B3D11D03BEC969B1C79C34C1D434
SHA-256:	445EE45F82C11BDAAEEF1A816C54D537307AFF9CB575ACFBC214ECA86231E133
SHA-512:	63DD2F870475A2E874A8055157AFF763CDD0450EE22EA4CBC9D5B636C931B4C4BC89EFAA4D9C4B88181803F9C93232BB4D879FA0DC82E0A6EF2078B194B97227
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P..\|............... ........@.. ....................................@.....................................O.......l....................`.......F..T............................................ ............... ..H............text....z... ...\|.................. ..`.rsrc...l............~..............@..@.reloc.......`.......(..............@..B.......................H........ ................. ............................................0............(....( .........(.....o!.........................("......(#......($......(%......(&....N..(....o....('....&..((.....s)........s........s+........s,........s-............0...........~....o.....+...0...........~....o/....+...0...........~....o0....+...0...........~....o1....+...0...........~....o2....+...0..<........~.....(3.....,!r...p.....(4...o5...s6............~.....+...0......

C:\Users\user\Desktop\Newtonsoft.Json.dll

Process:	C:\Users\user\Desktop\DHL #109#.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.341030762989627
Encrypted:	false
SSDEEP:	12288:H8sysTpPh7vlhCDw+y5U0wBc9B2o2CjqL2syUBCPdUSLnmOI3DChr:csysTpPh7vlhCDwiDO
MD5:	B83C19B329A8E5249C80FDE1C0FBE13C
SHA1:	8D65B680C245F77CC1E34CEA0FD1445849B98C1B
SHA-256:	EEA8A0433E933772CD5E26D8C857119220B45F2DC7CAB02514E85FDD930A95DF
SHA-512:	DD93447BDF86D9A26A41513BB1390D5B76E8B2931CB9141804DE4540E1732A55DA65332AFE7CFBBB3655A7B137C14813949463C85CE09A9566A129940AC594DB
Malicious:	false
Preview:	regfZ...Z...p.\..,.................. ....P......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...c8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.7694919964218427
Encrypted:	false
SSDEEP:	768:ns1M74nhfWGjIqNLK3XJ5GTyemcJwKpfi4RjU2xevhfWGjIq:EKcye
MD5:	1807C2DA34BD987F6ADC37BEED21B7B8
SHA1:	739481E905CDDBB2C1F77A6EFFBB34315417CFCB
SHA-256:	B27A9F8F6B0FE38A40EC2C2CA8C8B39AAECCFAC373F94899EA510E1154CD79EA
SHA-512:	B1C59FC58BAD96A66089F1458B9C50DD874B7C14289FCB2A8803DAB55795136239C9AB93134FC8EA7DC028B2E2FFB68BA208873977243C42F2E8701000410D0A
Malicious:	false
Preview:	regfY...Y...p.\..,.................. ....P......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...c8.................................................................................................................................................................................................................................................................................................................................................HvLE.>......Y....P......8.<2.X....bf...................@......hbin................p.\..,..........nk,.....c8......p........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .,b..c8...... ...........P............... .......Z.......................Root........lf......Root....nk .,b..c8...................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.367544982340551
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	DHL #109#.exe
File size:	1190400
MD5:	eb529efe16b4f7171fc8c4e132ce0c60
SHA1:	57847e14c4e9b3d11d03bec969b1c79c34c1d434
SHA256:	445ee45f82c11bdaaeef1a816c54d537307aff9cb575acfbc214eca86231e133
SHA512:	63dd2f870475a2e874a8055157aff763cdd0450ee22ea4cbc9d5b636c931b4c4bc89efaa4d9c4b88181803f9c93232bb4d879fa0dc82e0a6ef2078b194b97227
SSDEEP:	24576:AlGce7MTyPdLX2tuCAe/ZX81MjOxltKwJRWDnFeoS0EnTojbFA4Pdox/O:7GjKrJEFTEnTaFxoF
TLSH:	E2456A3A597A07E2D439F73502B1C430B6ADAF927313C958ADDA3EC2DF321806D9A51D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c..............P..\|............... ........@.. ....................................@................................

File Icon


Icon Hash:	c4c4c4c8ccd4d0c4

Static PE Info

General

Entrypoint:	0x509a0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63DCDB1D [Fri Feb 3 09:59:57 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1099b9	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10a000	0x1a86c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x126000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x104618	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x107a14	0x107c00	False	0.7890115891587678	data	7.513961549932198	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x10a000	0x1a86c	0x1aa00	False	0.18159477699530516	data	4.196918446455818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x126000	0xc	0x200	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x10a1d8	0x1dd8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x10bfb0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536
RT_ICON	0x11c7d8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384
RT_ICON	0x120a00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216
RT_ICON	0x122fa8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096
RT_ICON	0x124050	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024
RT_GROUP_ICON	0x1244b8	0x5a	data
RT_VERSION	0x124514	0x356	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 3, 2023 22:39:54.394956112 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:39:54.431924105 CET	80	49698	208.95.112.1	192.168.2.5
Feb 3, 2023 22:39:54.432086945 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:39:54.432769060 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:39:54.470513105 CET	80	49698	208.95.112.1	192.168.2.5
Feb 3, 2023 22:39:54.544879913 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.678345919 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.714962959 CET	80	49698	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:00.715116978 CET	49698	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.761763096 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.799536943 CET	80	49700	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:00.799612999 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.799840927 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:00.837584972 CET	80	49700	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:00.945302963 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.221915960 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.258157969 CET	80	49700	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:09.258286953 CET	49700	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.417965889 CET	49701	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.454423904 CET	80	49701	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:09.454529047 CET	49701	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.454806089 CET	49701	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:09.492547035 CET	80	49701	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:09.633541107 CET	49701	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:17.472984076 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:17.509562969 CET	80	49703	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:17.509699106 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:17.511776924 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:17.549612045 CET	80	49703	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:17.618606091 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.456475019 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.493937016 CET	80	49703	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:40.494081974 CET	49703	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.539910078 CET	49710	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.576241970 CET	80	49710	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:40.576359034 CET	49710	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.576634884 CET	49710	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.614341021 CET	80	49710	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:40.615566015 CET	49710	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:40.651834011 CET	80	49710	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:40.652040005 CET	49710	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:41.270363092 CET	49711	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:41.306651115 CET	80	49711	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:41.306761980 CET	49711	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:41.306978941 CET	49711	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:41.344449997 CET	80	49711	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:41.438124895 CET	49711	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:45.150598049 CET	80	49701	208.95.112.1	192.168.2.5
Feb 3, 2023 22:40:45.150731087 CET	49701	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:40:54.836849928 CET	49711	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:11.902285099 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:11.931803942 CET	80	49713	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:11.934271097 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:11.946316957 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:11.984361887 CET	80	49713	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:12.091984034 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:21.782710075 CET	80	49701	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:32.779378891 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:32.808584929 CET	80	49713	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:32.808671951 CET	49713	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:32.836050987 CET	49714	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:32.869904041 CET	80	49714	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:32.870340109 CET	49714	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:32.878995895 CET	49714	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:41:32.917643070 CET	80	49714	208.95.112.1	192.168.2.5
Feb 3, 2023 22:41:33.052405119 CET	49714	80	192.168.2.5	208.95.112.1
Feb 3, 2023 22:42:10.179280996 CET	80	49714	208.95.112.1	192.168.2.5
Feb 3, 2023 22:42:10.179466963 CET	49714	80	192.168.2.5	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 3, 2023 22:39:54.350110054 CET	56894	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:39:54.375919104 CET	53	56894	8.8.8.8	192.168.2.5
Feb 3, 2023 22:40:00.732829094 CET	50295	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:40:00.752862930 CET	53	50295	8.8.8.8	192.168.2.5
Feb 3, 2023 22:40:09.249152899 CET	60841	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:40:09.266767979 CET	53	60841	8.8.8.8	192.168.2.5
Feb 3, 2023 22:40:17.387315989 CET	60649	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:40:17.417973995 CET	53	60649	8.8.8.8	192.168.2.5
Feb 3, 2023 22:40:40.517981052 CET	49724	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:40:40.538813114 CET	53	49724	8.8.8.8	192.168.2.5
Feb 3, 2023 22:40:41.235953093 CET	61452	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:40:41.255065918 CET	53	61452	8.8.8.8	192.168.2.5
Feb 3, 2023 22:41:11.849711895 CET	51484	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:41:11.880604029 CET	53	51484	8.8.8.8	192.168.2.5
Feb 3, 2023 22:41:32.807945013 CET	63446	53	192.168.2.5	8.8.8.8
Feb 3, 2023 22:41:32.827498913 CET	53	63446	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 3, 2023 22:39:54.350110054 CET	192.168.2.5	8.8.8.8	0xcc28	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:00.732829094 CET	192.168.2.5	8.8.8.8	0xa91a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:09.249152899 CET	192.168.2.5	8.8.8.8	0x4a7a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:17.387315989 CET	192.168.2.5	8.8.8.8	0x72aa	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:40.517981052 CET	192.168.2.5	8.8.8.8	0x422d	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:41.235953093 CET	192.168.2.5	8.8.8.8	0x9148	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:41:11.849711895 CET	192.168.2.5	8.8.8.8	0xb6ec	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:41:32.807945013 CET	192.168.2.5	8.8.8.8	0x490	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 3, 2023 22:39:54.375919104 CET	8.8.8.8	192.168.2.5	0xcc28	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:00.752862930 CET	8.8.8.8	192.168.2.5	0xa91a	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:09.266767979 CET	8.8.8.8	192.168.2.5	0x4a7a	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:17.417973995 CET	8.8.8.8	192.168.2.5	0x72aa	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:40.538813114 CET	8.8.8.8	192.168.2.5	0x422d	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:40:41.255065918 CET	8.8.8.8	192.168.2.5	0x9148	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:41:11.880604029 CET	8.8.8.8	192.168.2.5	0xb6ec	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 3, 2023 22:41:32.827498913 CET	8.8.8.8	192.168.2.5	0x490	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49698	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:39:54.432769060 CET	93	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:39:54.470513105 CET	94	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:39:54 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49700	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:40:00.799840927 CET	94	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:40:00.837584972 CET	95	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:40:00 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 53 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49701	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:40:09.454806089 CET	96	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 3, 2023 22:40:09.492547035 CET	96	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:40:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 44 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49703	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:40:17.511776924 CET	107	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:40:17.549612045 CET	107	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:40:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 36 X-Rl: 41 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49710	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:40:40.576634884 CET	175	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 3, 2023 22:40:40.614341021 CET	176	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:40:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 13 X-Rl: 40 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49711	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:40:41.306978941 CET	177	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:40:41.344449997 CET	178	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:40:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 13 X-Rl: 39 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49713	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:41:11.946316957 CET	186	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:41:11.984361887 CET	186	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:41:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49714	208.95.112.1	80	C:\Users\user\Desktop\DHL #109#.exe

Timestamp	kBytes transferred	Direction	Data
Feb 3, 2023 22:41:32.878995895 CET	187	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 3, 2023 22:41:32.917643070 CET	188	IN	HTTP/1.1 200 OK Date: Fri, 03 Feb 2023 21:41:32 GMT Content-Type: application/json; charset=utf-8 Content-Length: 293 Access-Control-Allow-Origin: * X-Ttl: 39 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 47 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 67 22 2c 22 63 69 74 79 22 3a 22 48 75 6e 65 6e 62 65 72 67 22 2c 22 7a 69 70 22 3a 22 36 33 33 33 22 2c 22 6c 61 74 22 3a 34 37 2e 31 37 33 2c 22 6c 6f 6e 22 3a 38 2e 34 32 30 34 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 32 39 2e 31 34 33 2e 31 30 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZG","regionName":"Zug","city":"Hunenberg","zip":"6333","lat":47.173,"lon":8.4204,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"DET Africa (Pty) LTD","as":"AS212238 Datacamp Limited","query":"102.129.143.10"}

Target ID:	0
Start time:	22:39:29
Start date:	03/02/2023
Path:	C:\Users\user\Desktop\DHL #109#.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DHL #109#.exe
Imagebase:	0x4d0000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000000.00000002.371842107.00000000039AB000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000000.00000002.371842107.0000000003ACD000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Target ID:	1
Start time:	22:39:50
Start date:	03/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp6F29.tmp
Imagebase:	0x90000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	2
Start time:	22:39:50
Start date:	03/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	3
Start time:	22:39:51
Start date:	03/02/2023
Path:	C:\Users\user\Desktop\DHL #109#.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x7a0000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.601389886.0000000002C1E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000003.00000002.590990822.0000000000466000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000003.00000002.601389886.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Target ID:	4
Start time:	22:39:53
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
Imagebase:	0xd70000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000004.00000002.564712565.0000000004390000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low

Target ID:	5
Start time:	22:40:14
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Local\Temp\Zip.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Zip.exe"
Imagebase:	0x14b55360000
File size:	32256 bytes
MD5 hash:	AF07E88EC22CC90CEBFDA29517F101B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 00000005.00000000.405942498.0000014B55362000.00000002.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Zip.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	moderate

Target ID:	6
Start time:	22:40:14
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_230310.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Imagebase:	0x10000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	11
Start time:	22:40:16
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_230310.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Imagebase:	0xb20000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Target ID:	12
Start time:	22:40:22
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_230310.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Imagebase:	0xc0000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	20
Start time:	22:40:29
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_230310.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_230310.exe" / start
Imagebase:	0x230000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Target ID:	21
Start time:	22:40:29
Start date:	03/02/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1432
Imagebase:	0x20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Target ID:	23
Start time:	22:40:38
Start date:	03/02/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 1428
Imagebase:	0x20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Target ID:	24
Start time:	22:41:02
Start date:	03/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SDGUedyFqQlpw" /XML "C:\Users\user\AppData\Local\Temp\tmp85AA.tmp
Imagebase:	0x90000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	25
Start time:	22:41:02
Start date:	03/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Target ID:	26
Start time:	22:41:03
Start date:	03/02/2023
Path:	C:\Users\user\AppData\Roaming\SDGUedyFqQlpw.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xb60000
File size:	1190400 bytes
MD5 hash:	EB529EFE16B4F7171FC8C4E132CE0C60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Windows_Trojan_Lucifer_ce9d4cc8, Description: unknown, Source: 0000001A.00000002.603205973.000000000309F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown