Analysis Report Shipping Documents Original BL, Invoice & Pa.exe

Overview

General Information

Sample Name: Shipping Documents Original BL, Invoice & Pa.exe
Analysis ID: 403691
MD5: b89d3e7dd6ee20a09506365497f6cc3a
SHA1: d5a40ae65560da802d5c5135d024d5fa8e840ff4
SHA256: c2af0dcf4558a32fde15405648d8dd6410c51d319812755fcb8e4f742723bad7
Tags: exeNanoCoreRAT
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

DLL reload attack detected
Detected Nanocore Rat
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM3
Yara detected Nanocore RAT
.NET source code references suspicious native API functions
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "692d457c-2b26-4af6-a5f8-088a1838", "Group": "Default", "Domain1": "", "Domain2": "172.93.166.26", "Port": 4090, "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}
Yara detected Nanocore RAT
Source: Yara match File source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: Shipping Documents Original BL, Invoice & Pa.exe Joe Sandbox ML: detected

Compliance:

barindex
Uses 32bit PE files
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.1.dr
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07A4B700
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07A4CFA0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07A4DCA0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07A4DB60
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_07A4DAA0

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49722 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49723 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49724 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49725 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49726 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49727 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49728 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49729 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49730 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49731 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49732 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49733 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49734 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49735 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49736 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49737 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49738 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49739 -> 172.93.166.26:4090
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49740 -> 172.93.166.26:4090
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs:
Source: Malware configuration extractor URLs: 172.93.166.26
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GLOBALCOMPASSUS GLOBALCOMPASSUS
Source: unknown TCP traffic detected without corresponding DNS query: 2.20.142.209
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: unknown TCP traffic detected without corresponding DNS query: 172.93.166.26
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670534502.0000000002DD1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.654396019.0000000005FFC000.00000004.00000001.sdmp String found in binary or memory: http://www.ascendercorp.com/type
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: Shipping Documents Original BL, Invoice & Pa.exe String found in binary or memory: http://www.churchsw.org/church-projector-project
Source: Shipping Documents Original BL, Invoice & Pa.exe String found in binary or memory: http://www.churchsw.org/repository/Bibles/
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670478696.0000000001520000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.655221857.0000000005FFC000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.656756517.0000000005FFC000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.656074649.0000000005FFC000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html8
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670478696.0000000001520000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.como
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.651499309.000000000600B000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.653276119.0000000006005000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnt
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.659032488.0000000005FFB000.00000004.00000001.sdmp, Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.658535409.0000000005FFC000.00000004.00000001.sdmp, Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr0I
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.krK
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.krr
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.660037136.0000000006025000.00000004.00000001.sdmp String found in binary or memory: http://www.monot.
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr.
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kra-d
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.krcom
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.652728425.0000000005FFF000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kre
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000003.657239356.0000000005FFC000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.de
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.676141960.0000000006160000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709

E-Banking Fraud:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Shipping Documents Original BL, Invoice & Pa.exe
Source: initial sample Static PE information: Filename: Shipping Documents Original BL, Invoice & Pa.exe
Detected potential crypto function
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_014FC2B0 0_2_014FC2B0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_014F9990 0_2_014F9990
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A4ACE8 0_2_07A4ACE8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A4C138 0_2_07A4C138
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A457C8 0_2_07A457C8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A457D8 0_2_07A457D8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A45520 0_2_07A45520
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A45510 0_2_07A45510
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A40BD8 0_2_07A40BD8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A40B2B 0_2_07A40B2B
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A440F8 0_2_07A440F8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A40007 0_2_07A40007
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A45068 0_2_07A45068
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A47068 0_2_07A47068
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A45078 0_2_07A45078
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_07A40040 0_2_07A40040
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952BBB0 0_2_0952BBB0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_09528BAA 0_2_09528BAA
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_09520040 0_2_09520040
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952B3F8 0_2_0952B3F8
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952D590 0_2_0952D590
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952C620 0_2_0952C620
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952F858 0_2_0952F858
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952F868 0_2_0952F868
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952A800 0_2_0952A800
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952FAC0 0_2_0952FAC0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952FAB1 0_2_0952FAB1
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_095291A0 0_2_095291A0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952C098 0_2_0952C098
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952C0A0 0_2_0952C0A0
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_09523250 0_2_09523250
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952E240 0_2_0952E240
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952E231 0_2_0952E231
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952D55E 0_2_0952D55E
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952F630 0_2_0952F630
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952F621 0_2_0952F621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00BE5CF9 6_2_00BE5CF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00BE2148 6_2_00BE2148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00BE4A20 6_2_00BE4A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00BE2133 6_2_00BE2133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 6_2_00BE1A40 6_2_00BE1A40
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 8_2_00EC5868 8_2_00EC5868
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 8_2_00EC4580 8_2_00EC4580
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 8_2_00EC2148 8_2_00EC2148
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 8_2_00EC1A40 8_2_00EC1A40
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 8_2_00EC2133 8_2_00EC2133
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 10_2_01732370 10_2_01732370
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 10_2_01735208 10_2_01735208
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Code function: 10_2_01731A40 10_2_01731A40
PE file contains strange resources
Source: dhcpmon.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dhcpmon.exe.1.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs Shipping Documents Original BL, Invoice & Pa.exe
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.686876240.0000000009390000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs Shipping Documents Original BL, Invoice & Pa.exe
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.687212948.0000000009470000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSimpleUI.dll( vs Shipping Documents Original BL, Invoice & Pa.exe
Source: Shipping Documents Original BL, Invoice & Pa.exe Binary or memory string: OriginalFilenameManifestEnvelope.exeB vs Shipping Documents Original BL, Invoice & Pa.exe
Uses 32bit PE files
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dhcpmon.exe.1.dr, Microsoft.Build/CommandLine/OutOfProcTaskHostNode.cs Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: dhcpmon.exe.1.dr, Microsoft.Build/Shared/TaskLoader.cs Task registration methods: 'CreateTask'
Source: dhcpmon.exe.1.dr, Microsoft.Build/BackEnd/TaskParameter.cs Task registration methods: 'CreateNewTaskItemFrom'
Source: dhcpmon.exe.1.dr, Microsoft.Build/Shared/RegisteredTaskObjectCacheBase.cs Task registration methods: '.cctor', 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', '.ctor', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dhcpmon.exe.1.dr, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dhcpmon.exe.1.dr, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: dhcpmon.exe.1.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: dhcpmon.exe.1.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: dhcpmon.exe.1.dr, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: dhcpmon.exe, 0000000A.00000002.704185808.00000000033C1000.00000004.00000001.sdmp Binary or memory string: l)C:\Program Files (x86)\DHCP Monitor\*.sln
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: dhcpmon.exe, dhcpmon.exe.1.dr Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: dhcpmon.exe, 0000000A.00000002.704185808.00000000033C1000.00000004.00000001.sdmp Binary or memory string: *.slnP#
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD
Source: dhcpmon.exe, dhcpmon.exe.1.dr Binary or memory string: *.sln
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: /ignoreprojectextensions:.sln
Source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.
Source: classification engine Classification label: mal100.troj.evad.winEXE@15/14@0/1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Program Files (x86)\DHCP Monitor Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Shipping Documents Original BL, Invoice & Pa.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4804:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{692d457c-2b26-4af6-a5f8-088a183828b4}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4116:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1364:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Users\user\AppData\Local\Temp\tmpF57E.tmp Jump to behavior
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: unknown Process created: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe 'C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe'
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpF57E.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpF909.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpF57E.tmp' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpF909.tmp' Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Shipping Documents Original BL, Invoice & Pa.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: dhcpmon.exe, dhcpmon.exe.1.dr
Source: Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdbD source: dhcpmon.exe, 00000008.00000002.688516545.00000000005C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000A.00000002.703132653.0000000000F82000.00000002.00020000.sdmp, dhcpmon.exe.1.dr

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Code function: 0_2_0952E4F6 push ss; ret 0_2_0952E4F7
Source: initial sample Static PE information: section name: .text entropy: 7.68387820085

Persistence and Installation Behavior:

barindex
Creates processes with suspicious names
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe File created: \shipping documents original bl, invoice & pa.exe
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe File created: \shipping documents original bl, invoice & pa.exe Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpF57E.tmp'

Hooking and other Techniques for Hiding and Protection:

barindex
DLL reload attack detected
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Module Loaded: Original DLL: "C:\USERS\user\DESKTOP\SHIPPING DOCUMENTS ORIGINAL BL reload: INVOICE & PA.EXE"
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 4457 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 4934 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: foregroundWindowGot 624 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: foregroundWindowGot 706 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe TID: 484 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe TID: 4048 Thread sleep time: -102723s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe TID: 6016 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1368 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 960 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 864 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 3476 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Thread delayed: delay time: 102723 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: vmware
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.670633702.0000000002E4C000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
.NET source code references suspicious native API functions
Source: dhcpmon.exe.1.dr, Microsoft.Build/Shared/NativeMethodsShared.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 8.2.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 8.0.dhcpmon.exe.5c0000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 10.0.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 10.2.dhcpmon.exe.f80000.0.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 420000 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 422000 Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D0A008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpF57E.tmp' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmpF909.tmp' Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents Original BL, Invoice & Pa.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

barindex
Yara detected Nanocore RAT
Source: Yara match File source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Detected Nanocore Rat
Source: Shipping Documents Original BL, Invoice & Pa.exe, 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Source: MSBuild.exe, 00000001.00000003.686473988.000000000673C000.00000004.00000001.sdmp String found in binary or memory: NanoCore.ClientPluginHost
Yara detected Nanocore RAT
Source: Yara match File source: 00000000.00000002.673275544.0000000003DD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Shipping Documents Original BL, Invoice & Pa.exe PID: 5936, type: MEMORY
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Shipping Documents Original BL, Invoice & Pa.exe.3ee8c80.3.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 403691 Sample: Shipping Documents  Origina... Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 47 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 12 other signatures 2->53 8 Shipping Documents  Original BL, Invoice & Pa.exe 3 2->8         started        12 dhcpmon.exe 4 2->12         started        14 dhcpmon.exe 3 2->14         started        16 MSBuild.exe 2 2->16         started        process3 file4 43 Shipping Documents...nvoice & Pa.exe.log, ASCII 8->43 dropped 59 Writes to foreign memory regions 8->59 61 Injects a PE file into a foreign processes 8->61 18 MSBuild.exe 1 14 8->18         started        23 conhost.exe 12->23         started        25 conhost.exe 14->25         started        27 conhost.exe 16->27         started        signatures5 process6 dnsIp7 45 172.93.166.26, 4090, 49722, 49723 GLOBALCOMPASSUS United States 18->45 37 C:\Users\user\AppData\Roaming\...\run.dat, data 18->37 dropped 39 C:\Users\user\AppData\Local\...\tmpF57E.tmp, XML 18->39 dropped 41 C:\Program Files (x86)\...\dhcpmon.exe, PE32 18->41 dropped 55 Uses schtasks.exe or at.exe to add and modify task schedules 18->55 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->57 29 schtasks.exe 1 18->29         started        31 schtasks.exe 1 18->31         started        file8 signatures9 process10 process11 33 conhost.exe 29->33         started        35 conhost.exe 31->35         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.93.166.26
unknown United States
22653 GLOBALCOMPASSUS true

Contacted URLs

Name Malicious Antivirus Detection Reputation
true
  • Avira URL Cloud: safe
low
172.93.166.26 true
  • Avira URL Cloud: safe
unknown