26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c63a10d8a92a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c63a10d8a92a…. Malware family: Trojan.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830"],"about":{"@type":"SoftwareApplication","name":"DHL Receipt_AWB#6355646657577514374654-pdf.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta62,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000d00bb00b00100000000000000000000087766000000000020000000000000000000000080546800f87366001875660070a36800c07866000000000048f35f0000000000a4f55f004558f676e3590100feffffff0ce4f17672e1f17664c58474d042f276000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5847470a3680064c5847400000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000074016600000000000500000000410000500166001900000088306a00000000001900000094ef46001400000020f146004558f676eb430100feffffff000000000300000300d96900ec4100ad01000000eb591b760000000080000000a8f04600ec4100ad88306a000100000088306a00020000000c00000008e6690008e6690003e6690000000000cc7df400000066000000000114f046002447f47234f646004558f676cb430100feffffff1634f2764134f27694000000a000000002e6690000e6690094000000b8f14600b9141b765cf1460060f146001000000001000000 (UID: 00000000-00001524)28:T218b,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000288e6800b8f55f00e733f2761634f27684f65f0001000000940166000100000038f55f00b416f376c020ff769a16f376937faf7684f65f000100000001000000c0cc68000000000008f55f0038f55f00a4f55f004558f6767b310100feffffff9a16f376a519e47400007f7400000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006f006e005c0050007900740068006f006e00330038005c0053006300720069007000740073005c003b0043003a005c00000000000100000073005c0001000000000000000000000053005c000a00000a8611000028486a0020d969004c006f00630061006c005c00500072006f006700 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003b02f276e362b676f42e9072c0dd6800a0359072b362b67670e8460040cb6800def5f1768362b67680e84600000089720000897200000000dce74600f0000000f000897200000000ece746005300000080e94600000000000100000050e846006cf6f17600000000000000003ce84600 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c479c73a0c76f008c479c7300000000a0c76f009cde4600fd3ff276d820ff760000000050df460000000000de541271dcde46004558f67653420100feffffff4de7f3766056e474021000000000000000000100b0de4600e242f2768c479c730000000000000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006f006e005c0050007900740068006f006e00330038005c0053006300720069007000740073005c003b0043003a005c00000000000100000073005c00010000000000000000000000084095000a00000ab8a80000c0029600084095004c006f00630061006c005c00500072006f006700 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100c088f59805b29cbe743437c97200000000010000000000000001000000acf598050000000028127202e8f5980530379c00b8f598058f9cbe743437c97202000000000000001800000001000000bcf598052823df7200009200000000000c00000060227a02c8f598052f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2445676bc76ce74a8449c00209d9900ac449c00a8449c0030000000000000001cf1380050dc5a76a8449c003000000000000000cc67e004300000000200000000000000180000000919248544f138002823df7200009200000000000c00000028c7116d50f138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000f0f138006a6f127100000000bc6f12711417ebc570ed38000000000070f33800155ec375e09711b0feffffff7501cc75e2d8cd742824887202000000000000001800000030a5c972b0f138002823df7200009200000000000c00000030a5c972bcf138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005338aee72605a9c000000000070efc8052827ee72605a9c00b8efc8050723ed72605a9c0020000000000000005c37ed722812720220827a0228127202020000000000000018000000005a9c00bcefc8052823df7200009200000000000c00000020827a02c8efc8052f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2445676bc76ce74a0469c00209d9900a4469c00a0469c0030000000000000001cf1380050dc5a76a0469c0030000000000000002405e104300000000200000000000000180000000919248544f138002823df7200009200000000000c00000028c7116d50f138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000001000000c8f138006a6f127100000000bc6f12713c17ebc548ed38000000000070f33800155ec375e09711b0feffffff7501cc75e2d8cd742824887202000000000000001800000030a5c97288f138002823df7200009200000000000c00000030a5c97294f138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310005338aee72385f9c000000000030eebb052827ee72385f9c0078eebb050723ed72385f9c0020000000000000005c37ed722812720220c27a0228127202020000000000000018000000005f9c007ceebb052823df7200009200000000000c00000020c27a0288eebb052f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f2445676bc76ce74f8379a00209d9900fc379a00f8379a008000000000000000f8f0380050dc5a76f8379a0050000000000000002405e104500000000200000000000000180000006d19248520f138002823df7200009200000000000c00000028c7116d2cf138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310006338aee7250fe9e000000000060ed26062827ee7250fe9e00a8ed26060723ed7250fe9e0020000000000000005c37ed722812720220427d022812720202000000000000001800000000fe9e00aced26062823df7200009200000000000c00000020427d02b8ed26062f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310074d09da000209d990000000000e8599c001000000006000000e0f0380050dc5a76d09da0001000000084389a002405e104100000000cf13800a6ec116d02000000000000001800000028c7116d10f138002823df7200009200000000000c00000028c7116d1cf138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000050fe9e0084f13800338aee7250fe9e000000000090f138002827ee7250fe9e00dcf138000723ed7250fe9e002000000030a5c97201d5ed7202000000000000001800000004000000d0f138002823df7200009200000000000c00000030a5c972dcf138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310006338aee72a0ee9f000000000050f2d9062827ee72a0ee9f0098f2d9060723ed72a0ee9f0020000000000000005c37ed722812720220a27d022812720202000000000000001800000000ee9f009cf2d9062823df7200009200000000000c00000020a27d02a8f2d9062f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310074e8599c00209d990000000000e8599c001000000004000000dcf0380050dc5a76e8599c0010000000dc9f9f002405e1041000000008f13800a6ec116d02000000000000001800000028c7116d0cf138002823df7200009200000000000c00000028c7116d18f138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000a0ee9f0084f13800338aee72a0ee9f000000000090f138002827ee72a0ee9f00dcf138000723ed72a0ee9f002000000030a5c97201d5ed7202000000000000001800000004000000d0f138002823df7200009200000000000c00000030a5c972dcf138002f99c9720c000000 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003b02f276ef74c876f42ee56cd8559f00a035e56cdf74c87660ed380038829400def5f176cf74c87670ed38000000de6c0000de6c00000000ccec3800f0000000f000de6c00000000dcec38005300000070ee3800000000000100000040ed38006cf6f17600000000000000002ced3800 (UID: 00000000-00003268)29:Tc96,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")2a:T5238,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003268)2b:T1729e,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipImageForceValidation (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetImageType (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetImageRawFormat (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipBitmapGetPixel (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipBitmapSetPixel (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VaultEnumerateVaults (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VaultOpenVault (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter VaultEnumerateItems (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003268) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00003268)2c:T3570,Found reference to API (Indicator: "GetObject"; File: "DHL Receipt_AWB#6355646657577514374654-pdf.exe") Found reference to API (Indicator: "MessageBox"; File: "DHL Receipt_AWB#6355646657577514374654-pdf.exe") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000001.66133.01042000.00000020.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000001.66133.01042000.00000020.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001524.00000001.66133.04E50000.00000004.mdmp")2d:T3a1a,"NE\SOFTWARE\Class`" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp 00000000-00001372.00000001.73962.00300000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp 00000000-00001372.00000001.73962.00300000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W(" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C&" in Source: 00000000-00001372.00000000.72976.002B0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001372.00000000.72976.FF521000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001524.00000000.66118.00660000.00000004.mdmp 00000000-00001524.00000001.66133.00660000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001524.00000000.66118.00660000.00000004.mdmp 00000000-00001524.00000001.66133.00660000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003268.00000000.66374.003D0000.00000004.mdmp 00000000-00003268.00000002.70221.003D0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003268.00000000.66374.003D0000.00000004.mdmp 00000000-00003268.00000002.70221.003D0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcp" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePatD" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Pa <" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000002.70221.05A70000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Servic" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000002.70221.05A70000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Servic$" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Paramt" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "istry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPor" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|Su" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Ser" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp 00000000-00003268.00000003.88940.04E15000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000002.70221.05A70000.00000004.mdmp "gistry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BF~%" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterS" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtoco" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|Subn" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Paramete" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameter" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Servicec#" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000002.70221.04E1A000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMT" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "in32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|Ne" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parame{(" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp "n32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00003268.00000000.66374.00920000.00000004.mdmp 00000000-00003268.00000000.66374.05A70000.00000004.mdmp 00000000-00003268.00000001.68297.00920000.00000004.mdmp 00000000-00003268.00000002.70221.00920000.00000004.mdmp 00000000-00003268.00000003.88940.00920000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003268.00000000.66374.02720000.00000004.mdmp 00000000-00003268.00000001.68297.02720000.00000004.mdmp 00000000-00003268.00000003.88940.02720000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003268.00000000.66374.02720000.00000004.mdmp 00000000-00003268.00000001.68297.02720000.00000004.mdmp 00000000-00003268.00000003.88940.02720000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003268.00000000.66374.02720000.00000004.mdmp 00000000-00003268.00000001.68297.02720000.00000004.mdmp 00000000-00003268.00000003.88940.02720000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003268.00000000.66374.02720000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003268.00000000.66374.02720000.00000004.mdmp 00000000-00003268.00000001.68297.02720000.00000004.mdmp 00000000-00003268.00000003.88940.02720000.00000004.mdmp2e:Tfe4,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135] "DHLReceipt_AWB#6355646657577514374654-pdf.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]2f:T501,Observed unmanaged function "TG_GetDriverVersion" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_GetNewConnectionId" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_SetStreamLog" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_SetDataLog" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_Connect" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_ReadPackets" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_GetValue" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_GetValueStatus" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_SendByte" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_SetBaudrate" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_SetDataFormat" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_Disconnect" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe" Observed unmanaged function "TG_FreeConnection" in "DHL Receipt_AWB#6355646657577514374654-pdf.exe"30:T353d,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "GDI32.DLL" at base 74980000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76a90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 744f0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "KERNEL32" at base 761a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ed0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "ADVAPI32.DLL" at base 762b0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72e40000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "SHLWAPI.DLL" at base 74d00000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "VERSION.DLL" at base 742a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71030000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "USER32.DLL" at base 76860000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "MSCOREE.DLL" at base 73120000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "PSAPI.DLL" at base 74f70000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "KERNEL32.DLL" at base 761a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RPCRT4.DLL" at base 75c10000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fc20000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "OLE32.DLL" at base 74ba0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "CRYPTBASE.DLL" at base 74780000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73110000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72d00000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f1c0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 72920000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6e350000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "UXTHEME.DLL" at base 73ff0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6db30000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6da20000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6d2a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 730f0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "NTDLL.DLL" at base 76ef0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "SHELL32.DLL" at base 74f80000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 74e90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "PROFAPI.DLL" at base 75d00000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "BCRYPT.DLL" at base 72ce0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "CRYPTSP.DLL" at base 73da0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73a80000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "IMM32.DLL" at base 76a90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "COMCTL32.DLL" at base 72890000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "GDIPLUS.DLL" at base 73850000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73850000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 761a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "AMSI.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "WINDOWSCODECS.DLL" at base 73500000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6d0b0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "NTDLL" at base 76ef0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73df0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 74e90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RPCRTREMOTE.DLL" at base 73d90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6f010000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6e1a0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72ce0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6d980000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 729c0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6d200000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "BCRYPT.DLL" at base 730f0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 72890000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "CLBCATQ.DLL" at base 74ac0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72cc0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "OLEAUT32.DLL" at base 76560000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 730e0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 72c90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72880000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d100000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "SSPICLI.DLL" at base 74790000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RASAPI32.DLL" at base 6d070000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RTUTILS.DLL" at base 6d040000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 74e90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 74e90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "WS2_32.DLL" at base 75bd0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74380000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 6d030000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 6d020000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RASMAN.DLL" at base 6d050000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "WINHTTP.DLL" at base 6cfc0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "CREDSSP.DLL" at base 6cf60000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "IPHLPAPI.DLL" at base 74080000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "DHCPCSVC6.DLL" at base 743c0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "DHCPCSVC.DLL" at base 743d0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "NSI.DLL" at base 74e80000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "CFGMGR32.DLL" at base 76360000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 74e90000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "DNSAPI.DLL" at base 73b00000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "RASADHLP.DLL" at base 6cf50000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6cf10000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74e30000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "VAULTCLI.DLL" at base 6d0d0000 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "DHLReceipt_AWB#6355646657577514374654-pdf.exe" loaded module "COMCTL32.DLL" at base 6cde000031:T492,"0d000e002203167304f3460031c5f272@ADVAPI32.dll" "0d000e00fe021673f4f1460031c5f272@ADVAPI32.dll" "0b000c00cc02167384f5460031c5f272@ADVAPI32.dll" "10001100da02167388ec460031c5f272@ADVAPI32.dll" "150016003ccaf57274ee46000efdf372@ADVAPI32.dll" "0e000f00eccaf57274ee46000efdf372@ADVAPI32.dll" "0e000f0048cbf57274ee46000efdf372@ADVAPI32.dll" "1100120024d3f57274ee46000efdf372@ADVAPI32.dll" "11001200c0d3f57274ee46000efdf372@ADVAPI32.dll" "1200130004d4f57274ee46000efdf372@ADVAPI32.dll" "120013005cd4f57274ee46000efdf372@ADVAPI32.dll" "14001500ecf3f57274ee46000efdf372@ADVAPI32.dll" "1400150004f4f57274ee46000efdf372@ADVAPI32.dll" "140015001cf4f57274ee46000efdf372@ADVAPI32.dll" "1700180034f4f57274ee46000efdf372@ADVAPI32.dll" "0d000e004cf4f57274ee46000efdf372@ADVAPI32.dll" "0f00100078f5f57274ee46000efdf372@ADVAPI32.dll" "14001500b8f5f57274ee46000efdf372@ADVAPI32.dll" "14001500d0f5f57274ee46000efdf372@ADVAPI32.dll" "0c000d0018f6f57274ee46000efdf372@ADVAPI32.dll" "0c000d0028f6f57274ee46000efdf372@ADVAPI32.dll" "0e000f0038f6f57274ee46000efdf372@ADVAPI32.dll" "18001900a0f7f57274ee46000efdf372@RPCRT4.dll" "13001400ccf7f57274ee46000efdf372@RPCRT4.dll"32:T578,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")33:T633,"DHL Receipt_AWB#6355646657577514374654-pdf.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],aaa ,push esi,push ebx,inc ebx,inc edx,aaa ,inc ebx,dec eax,inc esi,push ebx,aaa ,pop ecx,push edx,xor al, 0x34,inc edi,xor eax, 0x45473458,xor al, 0,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.65AFD44A.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000fcc0,add rsp, 0x28,jmp 0x10000f0b8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x6da9],jne 0x10000f40b,rol rcx, 0x10,test cx, 0xffff,jne 0x10000f407,ret 0,ror rcx, 0x10,jmp 0x10000fd7c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov dword ptr [rsp + 0x18], r8d,mov qword ptr [rsp + 8], rcx,push rsi,push rdi,push r12,sub rsp, 0x40,"34:Tfe7,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00001524-00000C25-39555325] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001524-00000C25-39891448] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001524-00000C25-40000065] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001524-00000C25-40260798] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001524-00000C25-40306651] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001524-00000C25-40441499] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001524-00000C25-40475501] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001524-00000C25-40512253] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001524-00000C25-40611625] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001524-00000C25-40655995] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001524-00000C25-40678668] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001524-00000C25-40712110] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001524-00000C25-40867076] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001524-00000C25-40958068] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001524-00000C25-41355293] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001524-00000C25-41449418] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001524-00000C25-41494389] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001524-00000C25-41680592] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001524-00000C25-41941763] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001524-00000C25-41954869] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001524-00000C25-41969210] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00001524-00000C25-42051441] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00001524-00000C25-42905573] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003268-00000C25-45170738] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003268-00000C25-45288243]35:T7a6,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "")36:Td67,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DHLRECEIPT_AWB#6355646657577514374654-PDF"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "")37:T616,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"38:T730,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\FLTLIB.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"39:T79d,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"3a:T78d,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe.config" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mqju\" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\DHLReceipt_AWB#6355646657577514374654-pdf.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe.Local\" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\DHLRECEIPT_AWB#6355646657577514374654-PDF.EXE.CONFIG" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\MQJU" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\DHLRECEIPT_AWB#6355646657577514374654-PDF.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\DHLRECEIPT_AWB#6355646657577514374654-PDF.EXE.LOCAL"3b:T751,Heuristic match: ">n.mS" Heuristic match: "uv5.kP" Heuristic match: "^2.VA" Heuristic match: "xe.kh" Heuristic match: "( .Su" Heuristic match: "Q&.KH" Heuristic match: "ip-api.com" Heuristic match: "SE;.WSF;.WS" Heuristic match: "vmusbmouse.cat" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "m.Web.Co" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Heuristic match: "

8.Rs" Heuristic match: "?8.Rs" Heuristic match: ",8.Rs" Heuristic match: "!8.Rs" Heuristic match: "8.Rs" Heuristic match: "#8.Rs" Heuristic match: "$8.Rs" Heuristic match: "%8.Rs" Heuristic match: "&8.Rs" Heuristic match: "(8.Rs" Heuristic match: ")8.Rs" Heuristic match: "*8.Rs" Heuristic match: "+8.Rs" Heuristic match: ".8.Rs" Heuristic match: "/8.Rs" Heuristic match: "08.Rs" Heuristic match: "18.Rs" Heuristic match: "28.Rs" Heuristic match: "38.Rs" Heuristic match: "48.Rs" Heuristic match: "58.Rs" Heuristic match: "68.Rs" Heuristic match: "78.Rs" Heuristic match: "88.Rs" Heuristic match: "98.Rs" Heuristic match: ".N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.NF" Heuristic match: "i .am" Heuristic match: "I>G.VC" Heuristic match: ",(L.Je" Pattern match: "http://ip-api.com/line/?fields=hosting" Pattern match: "ip-api.com/line/?fields=hosting" Heuristic match: "CIM_System.Name" Heuristic match: "/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/"3c:T705,Found string "+ncalrpc:[OLE4D061146D0BE4093B3F586023D34]" (Indicator: "ncalrpc"; Source: "00000000-00001372.00000000.72976.002B0000.00000004.mdmp") Found string "+ncalrpc:[OLEBB183065EAC94A9D9138D00552D1]" (Indicator: "ncalrpc"; Source: "00000000-00001372.00000000.72976.002B0000.00000004.mdmp") Found string "+ncalrpc:[OLEFA4C25D0C8354ED39D958A388AF5]" (Indicator: "ncalrpc"; Source: "00000000-00001524.00000000.66118.00660000.00000004.mdmp, 00000000-00001524.00000001.66133.00660000.00000004.mdmp") Found string "+ncalrpc:[OLEDD96D1360A494A0380F81EE689AE]" (Indicator: "ncalrpc"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "+ncalrpc:[OLE956D62258A3844B793DAB893A82B]" (Indicator: "ncalrpc"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "B+ncalrpc:[OLE956D62258A3844B793DAB893A82B]" (Indicator: "ncalrpc"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp")3d:Tc84,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001524) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001524)3e:Td09,Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000000.66118.004A0000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000000.66118.004A0000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00001524.00000000.66118.00350000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001524.00000000.66118.00660000.00000004.mdmp, 00000000-00001524.00000001.66133.00660000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp")3f:T712,Found string "\Device\HarddiskVolume2\Windows\Temp\D7AADB61-5E5E-42BF-9112-56D42DBF9546\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00001372.00000000.72976.002B0000.00000004.mdmp") Found string "k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001524.00000000.66118.00660000.00000004.mdmp, 00000000-00001524.00000001.66133.00660000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp") Found string "\Device\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}" (Indicator: "\Device\"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.04E15000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.04E15000.00000004.mdmp")40:Tba2,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001372.00000000.72976.FF521000.00000020.mdmp")41:Td56,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSecurityDescriptorGroup" which can "Retrieves the primary group information from a security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSecurityDescriptorOwner" which can "Retrieves the owner information from a security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "IsValidSecurityDescriptor" which can "Determines whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "MakeAbsoluteSD" which can "Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.65AFD44A.bin]42:Te7f,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "SEARCHLIST"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")43:Tbdf,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\FTP NAVIGATOR\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\ROAMINGIPSWITCH\WS_FTP\SITES\WS_FTP.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Program Files (x86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Program Files (x86)\FTP COMMANDER\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\CFTP\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FTPGETTER\SERVERS.XML" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%APPDATA%\POCOMAIL\ACCOUNTS.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%APPDATA%\FILEZILLA\RECENTSERVERS.XML" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "Z:\FTP NAVIGATOR\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%APPDATA%\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%APPDATA%\PSWITCH\WS_FTP\SITES\WS_FTP.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%PROGRAMFILES%\(x86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%PROGRAMFILES%\(x86)\FTP COMMANDER\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "Z:\CFTP\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" opened file "%APPDATA%\FTPGETTER\SERVERS.XML"44:T751,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\POSTBOX\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\CLAWS-MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\OPERA MAIL\OPERA MAIL\WAND.DAT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%APPDATA%\THUNDERBIRD\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%APPDATA%\POSTBOX\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%APPDATA%\CLAWS-MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%APPDATA%\OPERA MAIL\OPERA MAIL\WAND.DAT" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "%APPDATA%\POCOMAIL\ACCOUNTS.INI"45:T4c5,"DHLReceipt_AWB#6355646657577514374654-pdf.exe wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000504500004c010300a602af650000000000000000e00002010b010b0000ae030000080000000000000ecc03000020000000e0030000004000002000000002000004000000000000000400000000000000002004000002000000000000020040850000100000100000000010000010000000000000100000000000000000000000c0cb03004b00000000e003004605000000000000000000000000000000000000000004000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002e7465787400000014ac03000020000000ae030000020000000000000000000000000000200000602e727372630000004605000000e003000006000000b00300000000000000000000000000400000402e72656c6f6300000c000000000004000002000000b603000000000000000000000000004000004200000000000000000000000000000000") to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" which might be an injection preparation attempt ...46:T416,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 32 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 52 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 4 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 8 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 512 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 241152 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644) "DHLReceipt_AWB#6355646657577514374654-pdf.exe" wrote 1536 bytes to a remote process "C:\DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Handle: 644)47:T706,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "DHLReceipt_AWB#6355646657577514374654-pdf.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES")48:T18b3,"DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\EDGE\USER DATA" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\yo4f78ka.default-1692790522796\LOGINS.JSON" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\yo4f78ka.default-1692790522796\SIGNONS.SQLITE" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\NETGATE TECHNOLOGIES\BLACKHAWK\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\K-MELEON\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MOONCHILD PRODUCTIONS\PALE MOON\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES.INI" "DHLReceipt_AWB#6355646657577514374654-pdf.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES.INI"49:T5d5,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp")4a:Td97,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.030C0000.00000004.mdmp, 00000000-00004920.00000000.68600.04FD0000.00000004.mdmp, 00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.030C0000.00000004.mdmp, 00000000-00004920.00000000.68600.04FD0000.00000004.mdmp, 00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.030C0000.00000004.mdmp, 00000000-00004920.00000000.68600.04FD0000.00000004.mdmp, 00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.04FD0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.04FD0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004920.00000000.68600.04FD0000.00000004.mdmp") Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.031D0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.05480000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.05480000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00006360.00000000.67988.05480000.00000004.mdmp")4b:T8b0,Found string "elect * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") Found string "nce of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000001.70520.03198000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03198000.00000004.mdmp") Found string "FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp") Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp") Found string "instance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00004920.00000002.72440.087BA000.00000004.mdmp")4c:T71d,"elect * from Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") "ELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") "ELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "00000000-00004920.00000001.70520.00400000.00000040.mdmp") "nce of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000001.70520.03198000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03198000.00000004.mdmp") "FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp") "Select * from Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp") "instance of Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp") "instance of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp")4d:T872,"c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "c63a1.Spy.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\C63A1_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790611085625,"unified_at":"2026-09-28T15:58:05.625Z","metadata":{"hashes":{"sha256":"c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","sha1":"6eaccf7f47bce432f1829027ed779d59d1ca7232","md5":"7ceb77f6e9e10e5bef32b5ad973f40c9","sha512":"76cf63587a7c0b4bff1fd436be3625ec0a3bbbf2bd048be2fbb873221a4559862aba171b3b22759f5d2b2b47cb396c265c1ed517c6384cbf31b462c1b1484995","ssdeep":"12288:T9jLBJI3vX9hpjfKTFmGMP2zx0VCrECmyrQPUKKqRLSP1VgS0YnKrKwnv6u8:5jruFhpmXNx0VIFeUKKq9PKDv","ssdeep_chunks":["12288:T9jLBJI","12288:9jLBJI3","12288:jLBJI3v","12288:LBJI3vX","12288:BJI3vX9","12288:JI3vX9h","12288:I3vX9hp","12288:3vX9hpj","12288:vX9hpjf","12288:X9hpjfK","12288:9hpjfKT","12288:hpjfKTF","12288:pjfKTFm","12288:jfKTFmG","12288:fKTFmGM","12288:KTFmGMP","12288:TFmGMP2","12288:FmGMP2z","12288:mGMP2zx","12288:GMP2zx0","12288:MP2zx0V","12288:P2zx0VC","12288:2zx0VCr","12288:zx0VCrE","12288:x0VCrEC","12288:0VCrECm","12288:VCrECmy","12288:CrECmyr","12288:rECmyrQ","12288:ECmyrQP","12288:CmyrQPU","12288:myrQPUK","12288:yrQPUKK","12288:rQPUKKq","12288:QPUKKqR","12288:PUKKqRL","12288:UKKqRLS","12288:KKqRLSP","12288:KqRLSP1","12288:qRLSP1V","12288:RLSP1Vg","12288:LSP1VgS","12288:SP1VgS0","12288:P1VgS0Y","12288:1VgS0Yn","12288:VgS0YnK","12288:gS0YnKr","12288:S0YnKrK","12288:0YnKrKw","12288:YnKrKwn","12288:nKrKwnv","12288:KrKwnv6","12288:rKwnv6u","12288:Kwnv6u8","24576:T9jLBJI","24576:9jLBJI3","24576:jLBJI3v","24576:LBJI3vX","24576:BJI3vX9","24576:JI3vX9h","24576:I3vX9hp","24576:3vX9hpj","24576:vX9hpjf","24576:X9hpjfK","24576:9hpjfKT","24576:hpjfKTF","24576:pjfKTFm","24576:jfKTFmG","24576:fKTFmGM","24576:KTFmGMP","24576:TFmGMP2","24576:FmGMP2z","24576:mGMP2zx","24576:GMP2zx0","24576:MP2zx0V","24576:P2zx0VC","24576:2zx0VCr","24576:zx0VCrE","24576:x0VCrEC","24576:0VCrECm","24576:VCrECmy","24576:CrECmyr","24576:rECmyrQ","24576:ECmyrQP","24576:CmyrQPU","24576:myrQPUK","24576:yrQPUKK","24576:rQPUKKq","24576:QPUKKqR","24576:PUKKqRL","24576:UKKqRLS","24576:KKqRLSP","24576:KqRLSP1","24576:qRLSP1V","24576:RLSP1Vg","24576:LSP1VgS","24576:SP1VgS0","24576:P1VgS0Y","24576:1VgS0Yn","24576:VgS0YnK","24576:gS0YnKr","24576:S0YnKrK","24576:0YnKrKw","24576:YnKrKwn","24576:nKrKwnv","24576:KrKwnv6","24576:rKwnv6u","24576:Kwnv6u8","12288:5jruFhp","12288:jruFhpm","12288:ruFhpmX","12288:uFhpmXN","12288:FhpmXNx","12288:hpmXNx0","12288:pmXNx0V","12288:mXNx0VI","12288:XNx0VIF","12288:Nx0VIFe","12288:x0VIFeU","12288:0VIFeUK","12288:VIFeUKK","12288:IFeUKKq","12288:FeUKKq9","12288:eUKKq9P","12288:UKKq9PK","12288:KKq9PKD","12288:Kq9PKDv"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"DHL Receipt_AWB#6355646657577514374654-pdf.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":657920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706020217000,"last_seen":1706198045000,"last_multi_scan":1706198045000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":181,"suspicious_count":19,"malicious_count":15,"total":215},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PWSX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AgentTesla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71313233","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71313233 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Spy.AgentTesla.I trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.AgentTesla.mq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005ac8e01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Agensla.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ABH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.HJL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Read system defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Tries to steal VPN information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal FTP credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found reference to \"DESCryptoServiceProvider\" (Indicator: \"DESCryptoServiceProvider\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found reference to \"RijndaelManaged\" (Indicator: \"Rijndael\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found reference to \"RijndaelManaged\" (Indicator: \"RijndaelManaged\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found reference to \"RC2u3Ol9WJ\" (Indicator: \"RC2\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")\n Found reference to \"System.Security.Cryptography.RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"DHL Receipt_AWB#6355646657577514374654-pdf.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"DHL Receipt_AWB#6355646657577514374654-pdf.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"DHL Receipt_AWB#6355646657577514374654-pdf.exe has big resource with name: \"Aus\" size: \"73217\" and abnormal entropy:\"7.99649118394\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001524.00000000.66118.004A0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003268.00000002.70221.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\COM3; Source: \"00000000-00001524.00000001.66133.01042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000000.66118.004A0000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00001524.00000001.66133.02550000.00000004.mdmp\"), Found string \"[ \\ ] ^ _ ` i\" (Indicator: \" ^ \"; Source: \"00000000-00001524.00000001.66133.02550000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.971361951221514","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Calls an API typically used to encrypt data\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"IsWow64Process\" with parameter \"1524\" - (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"IsWow64Process\" with parameter \"3268\" - (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001524)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"LookupAccountSidW\" with param Name u6QRAPk (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"LookupAccountSidW\" with param Name u6QRAPk (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001524)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001524.00000000.66118.00660000.00000004.mdmp\n 00000000-00001524.00000001.66133.00660000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"GetVersion\"; Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"Select * from Win32_ComputerSystem\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"$objects\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queries volume information of \"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe\" at 00000000-00001524-00000046-1310689\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queries volume information of \"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe\" at 00000000-00003268-00000046-1140926\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00003268-00000046-17699925\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Security\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Security.dll\" at 00000000-00003268-00000046-17706610","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY External IP Lookup ip-api.com\" (SID: 2022082, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003268)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateProcessA\" with parameter \"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe\" - (UID: 00000000-00001524)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000000.66118.004A0000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mqju.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"ut Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp\")\n Found reference to API \"ns|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp\")\n Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp, 00000000-00003268.00000000.66374.05A70000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.04E1A000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$2f","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Tue\n 23 Jan 2024 14:32:43 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FC20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72CE0000\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 730F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 70880000\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71030000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75C10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" was detected as \".NET\" and name: \"Library\"\n \"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.65AFD44A.bin\" was detected as \".NET\" and name: \"Library\"\n \"DISMHOST.EXE.65AFD44A.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$32","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.65AFD44A.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" has an executable section named \".text\"\n \"DISMHOST.EXE.65AFD44A.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.65AFD44A.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"DISMHOST.EXE.65AFD44A.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (UID: 00000000-00003268) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (UID: 00000000-00003268) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (UID: 00000000-00003268)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (UID: 00000000-00003268)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"DHL Receipt_AWB#6355646657577514374654-pdf.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dism.log\" has type \"data\"- [targetUID: N/A]\n \"DISMHOST.EXE.65AFD44A.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cryptsp.dll\" (UID: 3268)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Tries to identify its external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001524)\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003268-00000C26-46927843\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003268-00000C26-47147251\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003268-00000C26-47147836\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"10.0.0.0\"\n \"16.0.0.0\"\n \"192.168.241.129\"\n \"12.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0, Culture=neutral, PublicKe~\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" allowLocation=\"false\" />\", \"0.0.0.7\", \"0.0.0.1\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n C\", Potential IP \"0.0.0.0\" found in string \"0.0.0.0\n Cul\", Potential IP \"0.0.0.0\" found in string \"0.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\", \"255.255.252.0\", \"192.168.240.1\", \"8.8.8.8\", \"8.8.4.4\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=421276\" - Source: \"00000000-00001524.00000000.66118.00660000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=421276\" - Source: \"00000000-00001524.00000001.66133.00660000.00000004.mdmp\")\n Found URL \"http://ip-api.com/line/?fields=hostingt\" - Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d\n Observed JA3 fingerprint: db95a4cb23548a635a1dfebcee9991cb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"285280160\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"369167656\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001524.00000000.66118.00350000.00000004.mdmp, 00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00001524.00000001.66133.04E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00003268-00000C28-41801770101\")\n \"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00003268-00000C28-41810956581\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\SysWOW64\\cryptsp.dll\" (UID: 00000000-00003268)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003268-00000C26-160005807","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001372.00000000.72976.FF521000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" at 00000000-00001524-00000033-2582187\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" at 00000000-00003268-00000033-1943918","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queried SystemProcessInformation at 00000000-00003268-00000033-2152706 [PID: 3268]\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" queried SystemProcessInformation at 00000000-00003268-00000033-2153258 [PID: 3268]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.97837257293\n 7.36992295314","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"Select * from Win32_ComputerSystem\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY External IP Lookup ip-api.com\" (SID: 2022082, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.65AFD44A.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\HAPUBWS-PC\\root\\cimv2:Win32_NetworkAdapterConfiguration.Index=11\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.04DE0000.00000004.mdmp, 00000000-00003268.00000000.66374.05A70000.00000004.mdmp, 00000000-00003268.00000001.68297.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.04E0A000.00000004.mdmp, 00000000-00003268.00000003.88940.00920000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$43","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"Select * from Win32_ComputerSystem\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"$objects\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"$44","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal VPN information (file access)","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" trying to open a file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\NORDVPN\"\n \"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" trying to open a file \"%LOCALAPPDATA%\\NORDVPN\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-98","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.65AFD44A.bin\" claimed CRC 141269 while the actual is CRC 679156","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetVersionExA\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetTickCount\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" called \"CreateProcessA\" with parameter \"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe\" - (UID: 00000000-00001524)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"$45","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" allocated memory in \"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$46","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ip-api.com\" (Indicator: \"ip-api.com\"; File: \"PCAP\")\n \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\" (Indicator: \"ip-api.com\"; File: \"PCAP\")\n \"http://ip-api.com/line/?fields=hosting\" (Indicator: \"ip-api.com\"; File: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000000.66374.02720000.00000004.mdmp, 00000000-00003268.00000001.68297.02720000.00000004.mdmp, 00000000-00003268.00000003.88940.02720000.00000004.mdmp\")\n \"ttp://ip-api.com/line/?fields=hosting\" (Indicator: \"ip-api.com\"; File: \"00000000-00003268.00000000.66374.00920000.00000004.mdmp, 00000000-00003268.00000002.70221.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AgentTesla","description":"YARA signature Malware.AgentTesla matched on process \"00000000-00003268\"","origin":"YARA Signature","relevance":10,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - WorldwindStealer","description":"YARA signature WorldwindStealer matched on process \"00000000-00003268\"","origin":"YARA Signature","relevance":10,"id":"yara-133","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$47","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"DHLReceipt_AWB#6355646657577514374654-pdf.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$48","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"c63a1.Spy.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006360)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"c63a1.Spy.exe\" called \"LoadResource with parameter {'hModule': '134348801', 'hResInfo': '134350048'}\" (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"LoadResource with parameter {'hModule': '134348801', 'hResInfo': '134350080'}\" (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"LoadResource with parameter {'hModule': '134348801', 'hResInfo': '134350096'}\" (UID: 00000000-00006360)\n \"c63a1.Spy.exe\" called \"LoadResource with parameter {'hModule': '134348801', 'hResInfo': '134350064'}\" (UID: 00000000-00006360)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006360.00000000.67988.031D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006360.00000000.67988.031D0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006360.00000000.67988.05480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006360.00000000.67988.031D0000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006360.00000000.67988.05480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"PRIVATE KEY LOCATION: \"{0}\"]\" (Indicator: \"private key\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006360.00000000.67988.05480000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00006360.00000000.67988.05480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_VideoController\" (Indicator: \"select * from \"; Source: \"00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000001.70520.03198000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03198000.00000004.mdmp\")\n Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"c63a1.Spy.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006360)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_VideoController\" (Source: 00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000001.70520.03198000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03198000.00000004.mdmp, Indicator: \"select * from win32_videocontroller\")\n \"Select * from Win32_ComputerSystem\" (Source: 00000000-00004920.00000001.70520.03176000.00000004.mdmp, 00000000-00004920.00000002.72440.03176000.00000004.mdmp, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00004920.00000000.68600.04FD0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"c63a1.Spy.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73830000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"c63a1.Spy.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004920)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"c63a1.Spy.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\c63a1.spy.exe.log\"\n \"c63a1.Spy.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\c63a1.spy.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"c63a1.Spy.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\c63a1.Spy.exe.log\"\n \"c63a1.Spy.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\c63a1.Spy.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"smtp.crane-eletronics.com\" [Source: 00000000-00004920.00000000.68600.04FD0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")\n Found string \"GET /line/?fields=hosting HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"c63a1.Spy.exe\" called \"GetComputerNameW\" (UID: 00000000-00004920)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"c63a1.Spy.exe\" called \"GetUserNameW\" (UID: 00000000-00004920)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueEx\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyEx\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_CLEANBOO0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004920.00000001.70520.087A0000.00000004.mdmp, 00000000-00004920.00000002.72440.087A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00004920.00000002.72440.087BA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Office\\11.0\\Outlook\\Profiles\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Office\\12.0\\Outlook\\Profiles\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Office\\14.0\\Outlook\\Profiles\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Office\\15.0\\Outlook\\Profiles\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"oftware\\Microsoft\\Office\\16.0\\Outlook\\Profiles\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"VirtualStore\\Program Files\\Foxmail\\mail\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"VirtualStore\\Program Files (x86)\\Foxmail\\mail\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp\n \"Opera Mail\\Opera Mail\\wand.dat\" in Source: 00000000-00004920.00000001.70520.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"\"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftp navigator\")\n \"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"pswitch\\WS_FTP\\Sites\\ws_ftp.ini\" (Indicator: \"ws_ftp\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"cftp\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeId=\"*\">\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004920.00000000.68600.030C0000.00000004.mdmp, 00000000-00004920.00000001.70520.030C0000.00000004.mdmp, 00000000-00004920.00000002.72440.030C0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00004920.00000002.72440.087BA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004920.00000001.70520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00004920.00000000.68600.04FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"c63a1.Spy.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\c63a1.Spy.exe.log]- [targetUID: 00000000-00006360]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"08:00:27:56:B0:1B\" (Indicator: \"08:00:27\")\n \"BBDD-11EE-9C2A-08002756B01B}\" (Indicator: \"080027\")\n \"08002756B01B\" (Indicator: \"080027\")\n \"0bf17943b-0393-4bf5-87e6-693cc00b204308002756B01B\" (Indicator: \"080027\")\n \"{0A4F2A32-BBDD-11EE-9C2A-08002756B01B}\" (Indicator: \"080027\")\n \"-11EE-9C2A-08002756B01B}\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"c63a1.Spy.exe\" set thread context in remote process \"C:\\c63a1.Spy.exe\" (PID: 1338)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Executes WMI queries known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":113,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"65b2841ded5030654008a818","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ZZZ"],"submit_name":"c63a1.Spy.exe","analysis_start_time":"2024-01-25T15:54:05+00:00","indicators_count":{"informative":150,"suspicious":42,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65afcd79356209c72a0058b1","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ZZZ"],"submit_name":"DHL Receipt_AWB#6355646657577514374654-pdf.exe","analysis_start_time":"2024-01-23T14:30:17+00:00","indicators_count":{"informative":126,"suspicious":39,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"Reserved","registrar_name":"Internet Domain Service BS Corp.","registrar_organization":"Whois Privacy Corp.","registrar_name_servers":"A.IP-API.COM","registrar_creation_date":"2012-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=hosting","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}],"processes":[{"pid":1524,"ppid":0,"name":"DHLReceipt_AWB#6355646657577514374654-pdf.exe","command_line":"","sha256":"c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","normalized_path":"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe","uid":"00000000-00001524","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABCklEQVR4Xu2UzQ6CQAyEOYC+hIkXTiaKvv/DYQoplNm2++Nycr+ERPozMyDQdY1GAtfPPNOBdUnKTBEsnGqQMxsFzXOE+2f6rAqalYQgcmY3LBMvBNcub30Pay6LkLFkBWAoAPbWc30+wBMnYgEWbmEfz01i4lYfbz3O4LmJZUDsvVDc2yO83gEWotdIq6O57CWbxNDEtNqBu9PLhc3k/1r9KmNoZlrtNPQr1moh+m4BmhB/aNZaaCB3cLeITWTUnwdpIGu9CFovhPP+oxH9lnfrtxDjLjIY3wfNoG6IR5nQEmLK3zMpDZEzH0WGiAnzzDD5c9lgCAwi68OrsrkEQ+CB86dR72lv/BtfIairDPQdgFIAAAAASUVORK5CYII="},{"pid":3268,"ppid":1524,"name":"DHLReceipt_AWB#6355646657577514374654-pdf.exe","command_line":"","sha256":"c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830","normalized_path":"C:\\DHLReceipt_AWB#6355646657577514374654-pdf.exe","parent_uid":"00000000-00001524","uid":"00000000-00003268"}],"all_imported_dlls":["nsi.dll","System.Windows.Forms.ni.dll","shell32.dll","apphelp.dll","wow64cpu.dll","VxSSL32.dll","clrjit.dll","winhttp.dll","ntdll.dll","kernel32.dll","nlssorting.dll","bcrypt.dll","user32.dll","msvcrt.dll","mscoreei.dll","RpcRtRemote.dll","wbemcomn.dll","wbemsvc.dll","rtutils.dll","WSHTCPIP.DLL","wow64.dll","version.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","System.Management.ni.dll","ntdsapi.dll","rasapi32.dll","dhcpcsvc6.dll","dnsapi.dll","cryptbase.dll","api-ms-win-core-synch-l1-2-0.dll","imm32.dll","shlwapi.dll","System.Drawing.ni.dll","System.Windows.Forms.dll","credssp.dll","ole32.dll","rsaenh.dll","clbcatq.dll","fastprox.dll","cfgmgr32.dll","sechost.dll","rpcrt4.dll","sspicli.dll","fltLib.dll","gdi32.dll","clr.dll","uxtheme.dll","comctl32.dll","psapi.dll","System.Core.ni.dll","System.Xml.ni.dll","WindowsCodecs.dll","wmiutils.dll","wship6.dll","mscoree.dll","msctf.dll","System.Configuration.ni.dll","WMINet_Utils.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","System.Security.dll","wow64win.dll","usp10.dll","mscorlib.ni.dll","rasman.dll","dhcpcsvc.dll","lpk.dll","winnsi.dll","KernelBase.dll","ws2_32.dll","oleaut32.dll","vcruntime140_clr0400.dll","profapi.dll","cryptsp.dll","Microsoft.VisualBasic.ni.dll","wbemprox.dll","ucrtbase_clr0400.dll","GdiPlus.dll","webio.dll","rasadhlp.dll","vaultcli.dll","advapi32.dll","mscorrc.dll","mswsock.dll","sppc.dll","combase.dll","System.Management.dll","windows.storage.dll","amsi.dll","System.Drawing.dll","DWrite.dll","wldp.dll","dwmapi.dll","WinTypes.dll","msvcp_win.dll","wintrust.dll","MpClient.dll","kernel.appcore.dll","gdi32full.dll","powrprof.dll","bcryptprimitives.dll","msasn1.dll","SHCore.dll","Accessibility.dll","userenv.dll","MpOAV.dll","gpapi.dll","Microsoft.VisualBasic.dll","win32u.dll","ucrtbase.dll","crypt32.dll","slc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dism.log","sha256":"ca4168d9423c168df567a4d27945f0500e608f0b3fc8315893cea62fa1abe47d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"DISMHOST.EXE.65AFD44A.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"c63a1.Spy.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"},{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{EDF90A16-5DC7-4102-B811-8837E23F5ADB}","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\c63a1.Spy.exe.log","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\C63A1_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"65afcd79356209c72a0058b1"}]},{"name":"SM0:6360:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Local\\SM0:6360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"SM0:6360:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65b2841ded5030654008a818"}]}]}},"report_ids":{"sandbox_job_ids":["65b2841ded5030654008a818","65afcd79356209c72a0058b1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample c63a10d8a92a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c63a10d8a92a…. Malware family: Trojan.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample c63a10d8a92a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c63a10d8a92a…. Malware family: Trojan.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c63a10d8a92a5348801360fb963792f3f4309d6801eee6fa63038333f6b5d830"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample c63a10d8a92a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c63a10d8a92a…. Malware family: Trojan.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]