Windows Analysis Report
SHIPMENT DOCUMENTS.exe

Overview

General Information

Sample Name: SHIPMENT DOCUMENTS.exe
Analysis ID: 756110
MD5: 12dc06d3034a17be7a70a4aa45edce8d
SHA1: 9b68ae25498a12f19360dc0dc023af61ca9bfa9d
SHA256: 91826efe412b5c829801d1c52fbb43225cf1f0fc4cba201453ad877341c64b90
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected AgentTesla
Yara detected AntiVM3
Sigma detected: Scheduled temp file as task from temp location
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Initial sample is a PE file and has a suspicious name
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
.NET source code references suspicious native API functions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
May check the online IP address of the machine
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SHIPMENT DOCUMENTS.exe Virustotal: Detection: 36% Perma Link
Source: SHIPMENT DOCUMENTS.exe ReversingLabs: Detection: 32%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe ReversingLabs: Detection: 32%
Machine Learning detection for sample
Source: SHIPMENT DOCUMENTS.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.southernboilers.org", "Username": "info@southernboilers.org", "Password": "Sksmoke2018#"}
Uses 32bit PE files
Source: SHIPMENT DOCUMENTS.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 52.20.78.240:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: SHIPMENT DOCUMENTS.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wv6MCeq.pdb source: SHIPMENT DOCUMENTS.exe, cnWCiicEpxW.exe.0.dr

Networking
barindex
May check the online IP address of the machine
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe DNS query: name: api.ipify.org
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 199.79.62.12 199.79.62.12
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.6:49721 -> 199.79.62.12:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.6:49721 -> 199.79.62.12:587
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bvQtmz.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.defence.gov.au/pki0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518569851.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.387644774.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.494475191.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503345787.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.521128082.00000000013CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.546472929.0000000006603000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.microsoft.
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408011972.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403139297.0000000006616000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408642824.0000000006614000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408642824.0000000006614000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/C
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398769792.000000000715E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398611848.000000000715D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.20.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.544794129.0000000006540000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabm
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534528527.00000000033EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.southernboilers.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.accv.es0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.pki.gva.es0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401023380.000000000662C000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403450297.0000000006634000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408697131.0000000006630000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408538851.0000000006603000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://r3.i.lencr.org/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org/doc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.acabogacia.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.accv.es00
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ancert.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401023380.000000000662C000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408697131.0000000006630000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.chambersign.org1
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.comsign.co.il/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.402966476.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408391129.00000000065D8000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.defence.gov.au/pki0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.disig.sk/ca0f
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.dnie.es/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-me.lv/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546037308.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.eme.lv/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.globaltrust.info0=
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.oaticerts.com/repository.
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403712232.00000000065F1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546377934.00000000065F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/polic
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pki.gva.es/cps0%
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.rcsc.lt/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/cps/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.ssc.lt/cps03
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.517701606.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.522042764.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503605398.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.517701606.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.522042764.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503605398.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: cnWCiicEpxW.exe, 0000001B.00000002.528419495.0000000003164000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534484751.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.533917798.00000000033AA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://9psarY6l5Bj.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.orgmail.southernboilers.orginfo
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://eca.hinet.net/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://repository.luxtrust.lu0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.anf.es/address/)1(0&
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.catcert.net/verarrel05
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.hu/docs/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.netlock.net/docs
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 52.20.78.240:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.6:49738 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 21.2.cnWCiicEpxW.exe.2c8ba40.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.2dbba3c.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: SHIPMENT DOCUMENTS.exe
.NET source code contains very large array initializations
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bA3AE4E87u002d6B17u002d43BFu002dA428u002d978DE49F0210u007d/F3538611u002d2A69u002d4BECu002d82C0u002d433C1F04D64D.cs Large array initialization: .cctor: array initializer size 10983
Uses 32bit PE files
Source: SHIPMENT DOCUMENTS.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 21.2.cnWCiicEpxW.exe.2c8ba40.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.SHIPMENT DOCUMENTS.exe.2dbba3c.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Detected potential crypto function
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 0_2_02B7C64C 0_2_02B7C64C
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 0_2_02B7E8D8 0_2_02B7E8D8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 0_2_02B7E8C8 0_2_02B7E8C8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_02CFFC18 20_2_02CFFC18
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_02CF6D43 20_2_02CF6D43
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FFC5F8 20_2_05FFC5F8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FFA130 20_2_05FFA130
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FFD358 20_2_05FFD358
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FF0930 20_2_05FF0930
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FF0040 20_2_05FF0040
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FF2A40 20_2_05FF2A40
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B7D4E8 20_2_06B7D4E8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B78840 20_2_06B78840
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B727F6 20_2_06B727F6
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B723C0 20_2_06B723C0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B73730 20_2_06B73730
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B7249F 20_2_06B7249F
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B7D484 20_2_06B7D484
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B724E7 20_2_06B724E7
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B730D0 20_2_06B730D0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B72549 20_2_06B72549
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B75EB8 20_2_06B75EB8
Sample file is different than original file name gathered from version info
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCassa.dll< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000000.246208925.00000000009EE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.325190197.00000000077C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMajorRevision.exe< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000000.301859609.0000000000438000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.512831125.0000000000F38000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cnWCiicEpxW.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SHIPMENT DOCUMENTS.exe Virustotal: Detection: 36%
Source: SHIPMENT DOCUMENTS.exe ReversingLabs: Detection: 32%
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Jump to behavior
Source: SHIPMENT DOCUMENTS.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe {path}
Source: unknown Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmpC7C9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe {path}
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe {path} Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmpC7C9.tmp Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe {path} Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File created: C:\Users\user\AppData\Local\Temp\tmp2A80.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@12/7@6/3
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.533082657.0000000003197000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.533894309.00000000033A5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SHIPMENT DOCUMENTS.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_01
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Mutant created: \Sessions\1\BaseNamedObjects\SjgFZewpp
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_01
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Cryptographic APIs: 'CreateDecryptor'
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/f2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/f2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SHIPMENT DOCUMENTS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SHIPMENT DOCUMENTS.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SHIPMENT DOCUMENTS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wv6MCeq.pdb source: SHIPMENT DOCUMENTS.exe, cnWCiicEpxW.exe.0.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs .Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs .Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs .Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs .Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_05FF9308 push FFFFFF8Eh; iretd 20_2_05FF930C
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B73730 push es; iretd 20_2_06B744B0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B73730 push es; iretd 20_2_06B74548
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B73730 push es; iretd 20_2_06B745E0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Code function: 20_2_06B73730 push es; retf B740h 20_2_06B746F4
Source: initial sample Static PE information: section name: .text entropy: 7.505864996836325
Source: initial sample Static PE information: section name: .text entropy: 7.505864996836325
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'
Drops PE files
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 3180 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 2356 Thread sleep count: 9568 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99887s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99759s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99635s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99515s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99296s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99186s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -99077s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98859s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98747s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98624s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98510s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98380s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -98203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97732s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97608s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97364s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -97062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -96922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -96578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -96452s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -96310s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -96109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -95968s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -95832s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -95715s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -95562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -94406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -93250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -93062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -91250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -91000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90684s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90452s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90202s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -90078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89945s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89827s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89589s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89466s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876 Thread sleep time: -89356s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 2968 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 5972 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -12912720851596678s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 3536 Thread sleep count: 9400 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99588s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99485s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -99105s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98981s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98793s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98670s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98452s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98198s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -98004s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97718s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97390s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -97058s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -96920s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080 Thread sleep time: -96808s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Window / User API: threadDelayed 9568 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Window / User API: threadDelayed 9400 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99887 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99759 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99635 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99515 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99406 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99296 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99186 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 99077 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98968 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98859 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98747 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98624 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98510 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98380 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 98203 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97732 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97608 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97484 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97364 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97203 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 97062 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 96922 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 96578 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 96452 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 96310 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 96109 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 95968 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 95832 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 95715 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 95562 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 94406 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 93250 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 93062 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 91250 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 91000 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90843 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90684 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90562 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90452 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90343 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90202 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 90078 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89945 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89827 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89703 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89589 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89466 Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Thread delayed: delay time: 89356 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99859 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99703 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99588 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99485 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 99105 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98981 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98793 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98670 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98452 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98198 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 98004 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97860 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97718 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97390 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97281 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97172 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 97058 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 96920 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Thread delayed: delay time: 96808 Jump to behavior
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.397543098.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546575639.000000000660D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518569851.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396428303.0000000006606000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.397431025.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.397802691.000000000660B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: cnWCiicEpxW.exe, 0000001B.00000003.494475191.00000000013BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393067640.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.387644774.00000000010D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll__
Enables debug privileges
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/C1.cs Reference to suspicious API methods: ('A', 'VirtualAllocExNuma@kernel32.dll')
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/e2.cs Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Memory written: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Memory written: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe {path} Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmpC7C9.tmp Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe {path} Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cnWCiicEpxW.exe PID: 3132, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0000001B.00000002.528419495.0000000003164000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000002.524431731.0000000002F44000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cnWCiicEpxW.exe PID: 3132, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cnWCiicEpxW.exe PID: 3132, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 756110 Sample: SHIPMENT DOCUMENTS.exe Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 43 Malicious sample detected (through community Yara rule) 2->43 45 Sigma detected: Scheduled temp file as task from temp location 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 13 other signatures 2->49 7 cnWCiicEpxW.exe 5 2->7         started        10 SHIPMENT DOCUMENTS.exe 6 2->10         started        process3 file4 51 Multi AV Scanner detection for dropped file 7->51 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->53 55 May check the online IP address of the machine 7->55 59 2 other signatures 7->59 13 cnWCiicEpxW.exe 14 3 7->13         started        17 schtasks.exe 1 7->17         started        27 C:\Users\user\AppData\...\cnWCiicEpxW.exe, PE32 10->27 dropped 29 C:\Users\user\AppData\Local\...\tmp2A80.tmp, XML 10->29 dropped 31 C:\Users\user\...\SHIPMENT DOCUMENTS.exe.log, ASCII 10->31 dropped 57 Injects a PE file into a foreign processes 10->57 19 SHIPMENT DOCUMENTS.exe 15 3 10->19         started        21 schtasks.exe 1 10->21         started        signatures5 process6 dnsIp7 33 3.232.242.170, 443, 49738 AMAZON-AESUS United States 13->33 35 api.ipify.org 13->35 61 Tries to steal Mail credentials (via file / registry access) 13->61 63 Tries to harvest and steal ftp login credentials 13->63 65 Tries to harvest and steal browser information (history, passwords, etc) 13->65 23 conhost.exe 17->23         started        37 mail.southernboilers.org 199.79.62.12, 49721, 49743, 587 PUBLIC-DOMAIN-REGISTRYUS United States 19->37 39 api.ipify.org.herokudns.com 52.20.78.240, 443, 49713 AMAZON-AESUS United States 19->39 41 2 other IPs or domains 19->41 67 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->67 25 conhost.exe 21->25         started        signatures8 process9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
199.79.62.12
 mail.southernboilers.org United States
394695 PUBLIC-DOMAIN-REGISTRYUS false
3.232.242.170
 unknown United States
14618 AMAZON-AESUS false
52.20.78.240
 api.ipify.org.herokudns.com United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
mail.southernboilers.org 199.79.62.12 true
api.ipify.org.herokudns.com 52.20.78.240 true
windowsupdatebg.s.llnwi.net 178.79.242.0 true
api.ipify.org unknown unknown