Loading ...

Play interactive tourEdit tour

Analysis Report Shipping-Document.com

Overview

General Information

Sample Name:Shipping-Document.com (renamed file extension from com to exe)
Analysis ID:321421
MD5:47f1684c0075aea74bb225586d55b6e3
SHA1:7198622c341f1f6982eb20ac7a431508289df924
SHA256:58ba104e01f9650518e256c03102a8105428e761988ce5905de77cd45a53ad90

Most interesting Screenshot:

Detection

MassLogger RAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected MassLogger RAT
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
May check the online IP address of the machine
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Costura Assembly Loader
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • Shipping-Document.exe (PID: 1364 cmdline: 'C:\Users\user\Desktop\Shipping-Document.exe' MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • Shipping-Document.exe (PID: 3420 cmdline: C:\Users\user\Desktop\Shipping-Document.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • Shipping-Document.exe (PID: 1488 cmdline: C:\Users\user\Desktop\Shipping-Document.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
  • vlc.exe (PID: 1748 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe' MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 2792 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 6052 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 1872 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 4472 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 5352 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 1256 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
  • vlc.exe (PID: 3440 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe' MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 1012 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 4832 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
    • vlc.exe (PID: 484 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe MD5: 47F1684C0075AEA74BB225586D55B6E3)
  • cleanup

Malware Configuration

Threatname: MassLogger

{"Config: ": ["00000000 -> <|| v2.4.0.0 ||>", "User Name: user", "IP: 84.17.52.25", "Location: United States", "Windows OS: Microsoft Windows 10 Pro 64bit", "Windows Serial Key: VG7NF-BJ77Y-WRF7X-GJVW7-H3M8T", "CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "GPU: Microsoft Basic Display Adapter", "AV: Windows Defender", "Screen Resolution: 1280x1024", "Current Time: 11/21/2020 10:23:00 PM", "MassLogger Started: 11/21/2020 10:22:56 PM", "Interval: 2 hour", "MassLogger Process: C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe", "MassLogger Melt: false", "MassLogger Exit after delivery: false", "As Administrator: True", "Processes:", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "<|| WD Exclusion ||>", "Disabled", "<|| Binder ||>", "Disabled", "<|| Downloader ||>", "Disabled", "<|| Window Searcher ||>", "Disabled", "<|| Bot Killer ||>", "Disabled", "<|| Search And Upload ||>", "Disabled", "<|| Telegram Desktop ||>", "Not Installed", "<|| Pidgin ||>", "Not Installed", "<|| FileZilla ||>", "Not Installed", "<|| Discord Tokken ||>", "Not Installed", "<|| NordVPN ||>", "Not Installed", "<|| Outlook ||>", "Not Installed", "<|| FoxMail ||>", "Not Installed", "<|| Thunderbird ||>", "Not Installed", "<|| FireFox ||>", "Not Installed", "<|| QQ Browser ||>", "Not Installed", "<|| Chromium Recovery ||>", "Not Installed or Not Found", "<|| Keylogger And Clipboard ||>", "NA"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000000.00000002.292894367.0000000003997000.00000004.00000001.sdmpJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
        00000016.00000002.474961619.0000000000402000.00000040.00000001.sdmpJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
          0000000C.00000003.392005702.00000000048A0000.00000004.00000001.sdmpJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
            Click to see the 23 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            26.2.vlc.exe.400000.0.unpackJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
              5.2.Shipping-Document.exe.400000.0.unpackJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
                22.2.vlc.exe.400000.0.unpackJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security

                  Sigma Overview

                  No Sigma rule has matched

                  Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: Log.txt.26.dr.binstrMalware Configuration Extractor: MassLogger {"Config: ": ["00000000 -> <|| v2.4.0.0 ||>", "User Name: user", "IP: 84.17.52.25", "Location: United States", "Windows OS: Microsoft Windows 10 Pro 64bit", "Windows Serial Key: VG7NF-BJ77Y-WRF7X-GJVW7-H3M8T", "CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "GPU: Microsoft Basic Display Adapter", "AV: Windows Defender", "Screen Resolution: 1280x1024", "Current Time: 11/21/2020 10:23:00 PM", "MassLogger Started: 11/21/2020 10:22:56 PM", "Interval: 2 hour", "MassLogger Process: C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe", "MassLogger Melt: false", "MassLogger Exit after delivery: false", "As Administrator: True", "Processes:", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "Name:nrsfQCpnoELUtpNHbSOcsFhHJG, Title:Chrome", "<|| WD Exclusion ||>", "Disabled", "<|| Binder ||>", "Disabled", "<|| Downloader ||>", "Disabled", "<|| Window Searcher ||>", "Disabled", "<|| Bot Killer ||>", "Disabled", "<|| Search And Upload ||>", "Disabled", "<|| Telegram Desktop ||>", "Not Installed", "<|| Pidgin ||>", "Not Installed", "<|| FileZilla ||>", "Not Installed", "<|| Discord Tokken ||>", "Not Installed", "<|| NordVPN ||>", "Not Installed", "<|| Outlook ||>", "Not Installed", "<|| FoxMail ||>", "Not Installed", "<|| Thunderbird ||>", "Not Installed", "<|| FireFox ||>", "Not Installed", "<|| QQ Browser ||>", "Not Installed", "<|| Chromium Recovery ||>", "Not Installed or Not Found", "<|| Keylogger And Clipboard ||>", "NA"]}
                  Multi AV Scanner detection for dropped fileShow sources
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeVirustotal: Detection: 20%Perma Link
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeReversingLabs: Detection: 20%
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: Shipping-Document.exeVirustotal: Detection: 20%Perma Link
                  Source: Shipping-Document.exeReversingLabs: Detection: 20%
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Jump to behavior

                  Networking:

                  barindex
                  May check the online IP address of the machineShow sources
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: unknownDNS query: name: api.ipify.org
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 54.243.164.148 54.243.164.148
                  Source: Joe Sandbox ViewIP Address: 54.243.164.148 54.243.164.148
                  Source: Joe Sandbox ViewIP Address: 54.235.142.93 54.235.142.93
                  Source: Joe Sandbox ViewIP Address: 54.235.142.93 54.235.142.93
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
                  Source: Shipping-Document.exe, 00000005.00000002.483989726.0000000002DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: fUsage: https://www.youtube.com/watch?v=Qxk6cu21JSg equals www.youtube.com (Youtube)
                  Source: unknownDNS traffic detected: queries for: api.ipify.org
                  Source: Shipping-Document.exe, 00000005.00000002.485116357.0000000002FB4000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org
                  Source: Shipping-Document.exe, 00000005.00000002.483989726.0000000002DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org/
                  Source: Shipping-Document.exe, 00000005.00000002.484657984.0000000002EDA000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.485932807.0000000002D0F000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.485514489.0000000003130000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org/P
                  Source: Shipping-Document.exe, 00000005.00000002.484657984.0000000002EDA000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.485932807.0000000002D0F000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.485514489.0000000003130000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.org/p
                  Source: Shipping-Document.exe, 00000005.00000002.483989726.0000000002DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify.orgD
                  Source: vlc.exe, 0000001A.00000002.485514489.0000000003130000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify8
                  Source: vlc.exe, 00000016.00000002.486012293.0000000002D1B000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify8R
                  Source: Shipping-Document.exe, 00000005.00000002.485070930.0000000002FAF000.00000004.00000001.sdmpString found in binary or memory: http://api.ipify8v
                  Source: Shipping-Document.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
                  Source: Shipping-Document.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
                  Source: Shipping-Document.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                  Source: Shipping-Document.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                  Source: Shipping-Document.exeString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                  Source: Shipping-Document.exeString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
                  Source: Shipping-Document.exeString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                  Source: Shipping-Document.exe, 00000005.00000002.485116357.0000000002FB4000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.486045579.0000000002D20000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.485599592.0000000003142000.00000004.00000001.sdmpString found in binary or memory: http://elb097307-934924932.us-east-1.elb.amazonaws.com
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
                  Source: Shipping-Document.exeString found in binary or memory: http://ocsp.digicert.com0A
                  Source: Shipping-Document.exeString found in binary or memory: http://ocsp.digicert.com0C
                  Source: Shipping-Document.exeString found in binary or memory: http://ocsp.digicert.com0L
                  Source: Shipping-Document.exeString found in binary or memory: http://ocsp.digicert.com0N
                  Source: Shipping-Document.exeString found in binary or memory: http://ocsp.digicert.com0O
                  Source: Shipping-Document.exe, 00000005.00000002.483989726.0000000002DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
                  Source: vlc.exe, 0000001A.00000002.488438717.0000000004091000.00000004.00000001.sdmpString found in binary or memory: http://www.codeplex.com/DotNetZip
                  Source: Shipping-Document.exeString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
                  Source: vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
                  Source: vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                  Source: Shipping-Document.exe, 00000000.00000002.297409828.0000000005850000.00000002.00000001.sdmp, vlc.exe, 0000000C.00000002.405013728.0000000006110000.00000002.00000001.sdmp, vlc.exe, 0000000E.00000002.426931776.00000000055D0000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                  Source: Shipping-Document.exeString found in binary or memory: https://www.digicert.com/CPS0
                  Source: Shipping-Document.exe, 00000005.00000002.483989726.0000000002DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.484501673.0000000002B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.484549006.0000000002F71000.00000004.00000001.sdmpString found in binary or memory: https://www.youtube.com/watch?v=Qxk6cu21JSg

                  System Summary:

                  barindex
                  Initial sample is a PE file and has a suspicious nameShow sources
                  Source: initial sampleStatic PE information: Filename: Shipping-Document.exe
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 0_2_0278C1B40_2_0278C1B4
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 0_2_0278E6100_2_0278E610
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 0_2_0278E6000_2_0278E600
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 3_2_003F46673_2_003F4667
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_009946675_2_00994667
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_052707905_2_05270790
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_052705075_2_05270507
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_052705185_2_05270518
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_052760FB5_2_052760FB
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_069708185_2_06970818
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_069765615_2_06976561
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_069765685_2_06976568
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_00BE466712_2_00BE4667
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_0176C1B412_2_0176C1B4
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_0176E61012_2_0176E610
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_0176E60012_2_0176E600
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_08A454C812_2_08A454C8
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 14_2_000B466714_2_000B4667
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 14_2_00A5C1B414_2_00A5C1B4
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 14_2_00A5E60014_2_00A5E600
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 14_2_00A5E61014_2_00A5E610
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 14_2_069854C814_2_069854C8
                  Source: Shipping-Document.exeStatic PE information: invalid certificate
                  Source: Shipping-Document.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: vlc.exe.0.drStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                  Source: Shipping-Document.exe, 00000000.00000002.293468023.0000000003B77000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameClassLibrary3.dll< vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000000.00000002.290016295.00000000029B9000.00000004.00000001.sdmpBinary or memory string: OriginalFilename" vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000000.00000002.292894367.0000000003997000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEeyxsdnaklophm.dll4 vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000000.00000002.288880734.00000000005C2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUlzzwremyvkd6.exe< vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000000.00000002.298541463.0000000006FD0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000003.00000002.283415905.0000000000562000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUlzzwremyvkd6.exe< vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000000.284472154.0000000000B02000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUlzzwremyvkd6.exe< vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.489874672.0000000005310000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.488191884.0000000003DE1000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameIonic.Zip.dllD vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.474947911.0000000000402000.00000040.00000001.sdmpBinary or memory string: OriginalFilename" vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.479489682.0000000000EF4000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.492785493.0000000006090000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Shipping-Document.exe
                  Source: Shipping-Document.exe, 00000005.00000002.494723433.0000000006E40000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Shipping-Document.exe
                  Source: Shipping-Document.exeBinary or memory string: OriginalFilenameUlzzwremyvkd6.exe< vs Shipping-Document.exe
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@25/10@7/3
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLANJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Local\Temp\DotNetZip-fu3v0fes.tmpJump to behavior
                  Source: Shipping-Document.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                  Source: C:\Users\user\Desktop\Shipping-Document.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                  Source: C:\Users\user\Desktop\Shipping-Document.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM WIN32_PROCESSOR
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM WIN32_PROCESSOR
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM WIN32_PROCESSOR
                  Source: C:\Users\user\Desktop\Shipping-Document.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hosts
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hosts
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeFile read: C:\Windows\System32\drivers\etc\hosts
                  Source: Shipping-Document.exeVirustotal: Detection: 20%
                  Source: Shipping-Document.exeReversingLabs: Detection: 20%
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile read: C:\Users\user\Desktop\Shipping-Document.exeJump to behavior
                  Source: unknownProcess created: C:\Users\user\Desktop\Shipping-Document.exe 'C:\Users\user\Desktop\Shipping-Document.exe'
                  Source: unknownProcess created: C:\Users\user\Desktop\Shipping-Document.exe C:\Users\user\Desktop\Shipping-Document.exe
                  Source: unknownProcess created: C:\Users\user\Desktop\Shipping-Document.exe C:\Users\user\Desktop\Shipping-Document.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe'
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess created: C:\Users\user\Desktop\Shipping-Document.exe C:\Users\user\Desktop\Shipping-Document.exeJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess created: C:\Users\user\Desktop\Shipping-Document.exe C:\Users\user\Desktop\Shipping-Document.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                  Source: Shipping-Document.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: Shipping-Document.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                  Source: Shipping-Document.exeStatic file information: File size 1631688 > 1048576
                  Source: Shipping-Document.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x16ec00
                  Source: Shipping-Document.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                  Source: Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: Shipping-Document.exe, 00000005.00000002.488191884.0000000003DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.488378125.0000000003B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.488438717.0000000004091000.00000004.00000001.sdmp
                  Source: Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: Shipping-Document.exe, 00000005.00000002.488191884.0000000003DE1000.00000004.00000001.sdmp, vlc.exe, 00000016.00000002.488378125.0000000003B51000.00000004.00000001.sdmp, vlc.exe, 0000001A.00000002.488438717.0000000004091000.00000004.00000001.sdmp

                  Data Obfuscation:

                  barindex
                  Yara detected Costura Assembly LoaderShow sources
                  Source: Yara matchFile source: Process Memory Space: Shipping-Document.exe PID: 1488, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 3440, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Shipping-Document.exe PID: 1364, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 1748, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 1256, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: vlc.exe PID: 484, type: MEMORY
                  Source: C:\Users\user\Desktop\Shipping-Document.exeCode function: 5_2_05E83121 push ecx; iretd 5_2_05E83122
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeCode function: 12_2_056C1C34 push 9400005Eh; ret 12_2_056C1C39
                  Source: Shipping-Document.exe, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: Shipping-Document.exe, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: vlc.exe.0.dr, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: vlc.exe.0.dr, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 0.0.Shipping-Document.exe.450000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 0.0.Shipping-Document.exe.450000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 0.2.Shipping-Document.exe.450000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 0.2.Shipping-Document.exe.450000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 3.2.Shipping-Document.exe.3f0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 3.2.Shipping-Document.exe.3f0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 3.0.Shipping-Document.exe.3f0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 3.0.Shipping-Document.exe.3f0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 5.0.Shipping-Document.exe.990000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 5.0.Shipping-Document.exe.990000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 5.2.Shipping-Document.exe.990000.1.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 5.2.Shipping-Document.exe.990000.1.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 12.2.vlc.exe.be0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 12.2.vlc.exe.be0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 12.0.vlc.exe.be0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 12.0.vlc.exe.be0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 14.0.vlc.exe.b0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 14.0.vlc.exe.b0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 14.2.vlc.exe.b0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 14.2.vlc.exe.b0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 17.2.vlc.exe.4b0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 17.2.vlc.exe.4b0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 17.0.vlc.exe.4b0000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 17.0.vlc.exe.4b0000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 18.0.vlc.exe.230000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 18.0.vlc.exe.230000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 18.2.vlc.exe.230000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 18.2.vlc.exe.230000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 19.0.vlc.exe.90000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 19.0.vlc.exe.90000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 19.2.vlc.exe.90000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 19.2.vlc.exe.90000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 20.2.vlc.exe.190000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 20.2.vlc.exe.190000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: 20.0.vlc.exe.190000.0.unpack, YtcOIiYW7VgAbHvwdB/kpAZSmNgi4DbiAxh4h.csHigh entropy of concatenated method names: 'FW7nVgAbH', 'xwdKBQPgt', 'zEduoirWU', 'IrgANIu18', 'PRGffQ9AR', 'r2UtKKWYh', 'EaY3dNjU5', 'X1JW1Hd12', '.ctor', 'VMmMgtrPw'
                  Source: 20.0.vlc.exe.190000.0.unpack, WstHBVgG0NBqQWrFPh/HH9IqwrjyRGGR3Lw3Z.csHigh entropy of concatenated method names: '.ctor', 'HH9rIqwjy', 'Dispose', 'wGGgR3Lw3', 'q0QYk7yp22XHr0rIkj', 'OnnkTqOhMKsFRFDhJW', 'Q7x0MnYyUAQRwLmZVe', 'K29tKk7mUs7qVSeYxK', 'IiFHGbCy4f0lL65uUi', 'vsjmkeKORRHjOulBpA'
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to dropped file
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLANJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe\:Zone.Identifier:$DATAJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlcJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vlcJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Shipping-Document.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exeProcess information set: NOOPENFILEERRORBOX