Windows Analysis Report
SHIPMENT DOCUMENTS.exe

AV Detection

Source: SHIPMENT DOCUMENTS.exe	Virustotal: Detection: 36%			Perma Link
Source: SHIPMENT DOCUMENTS.exe	ReversingLabs: Detection: 32%

Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe

ReversingLabs: Detection: 32%

Source: SHIPMENT DOCUMENTS.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe

Joe Sandbox ML: detected

Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.southernboilers.org", "Username": "info@southernboilers.org", "Password": "Sksmoke2018#"}

Compliance

Source: SHIPMENT DOCUMENTS.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.20.78.240:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.6:49738 version: TLS 1.2

Source: SHIPMENT DOCUMENTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: wv6MCeq.pdb source: SHIPMENT DOCUMENTS.exe, cnWCiicEpxW.exe.0.dr

Networking

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	DNS query: name: api.ipify.org

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View

IP Address: 199.79.62.12 199.79.62.12

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.6:49721 -> 199.79.62.12:587

Source: global traffic

TCP traffic: 192.168.2.6:49721 -> 199.79.62.12:587

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bvQtmz.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518569851.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.387644774.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.494475191.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503345787.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.521128082.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393081850.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518974908.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520153626.0000000001396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.546472929.0000000006603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408011972.00000000065C1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403139297.0000000006616000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408642824.0000000006614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408642824.0000000006614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/C
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398769792.000000000715E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398611848.000000000715D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/CABD2A79A1076A31F21D253635CB0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.20.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.544794129.0000000006540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabm
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534528527.00000000033EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.southernboilers.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401023380.000000000662C000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403450297.0000000006634000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408697131.0000000006630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408538851.0000000006603000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.392950428.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.519279531.000000000135D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.408437609.00000000070C4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401023380.000000000662C000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408697131.0000000006630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546353573.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.402966476.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408391129.00000000065D8000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403880249.00000000065E1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.406958224.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403696848.00000000065EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546037308.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.403712232.00000000065F1000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546377934.00000000065F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/polic
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403853962.00000000065DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.398696766.0000000007129000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.401258901.0000000007125000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.315590285.0000000006E62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403942163.00000000065CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.517701606.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.522042764.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503605398.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.517701606.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.516536811.000000000107D000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.393347400.0000000006586000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.533736666.00000000031E6000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.520315185.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.522042764.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000003.503605398.00000000013E6000.00000004.00000020.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: cnWCiicEpxW.exe, 0000001B.00000002.528419495.0000000003164000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534484751.00000000033EB000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.534582730.00000000033F5000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.533917798.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://9psarY6l5Bj.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgmail.southernboilers.orginfo
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398941782.00000000065B9000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.403651123.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eca.hinet.net/repository0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407487472.00000000070CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.400439346.00000000065EF000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.401332216.00000000065F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398836058.00000000065AD000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.407868660.00000000065AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.407915366.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.522417697.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.525674867.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.398450527.0000000007136000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 52.20.78.240:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.232.242.170:443 -> 192.168.2.6:49738 version: TLS 1.2

System Summary

Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 21.2.cnWCiicEpxW.exe.2c8ba40.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.2dbba3c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

Source: initial sample

Static PE information: Filename: SHIPMENT DOCUMENTS.exe

Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007bA3AE4E87u002d6B17u002d43BFu002dA428u002d978DE49F0210u007d/F3538611u002d2A69u002d4BECu002d82C0u002d433C1F04D64D.cs

Large array initialization: .cctor: array initializer size 10983

Source: SHIPMENT DOCUMENTS.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 21.2.cnWCiicEpxW.exe.2c8ba40.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.SHIPMENT DOCUMENTS.exe.2dbba3c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3d715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.SHIPMENT DOCUMENTS.exe.3ea28e8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000014.00000000.301553016.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3244, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 0_2_02B7C64C		0_2_02B7C64C
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 0_2_02B7E8D8		0_2_02B7E8D8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 0_2_02B7E8C8		0_2_02B7E8C8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_02CFFC18		20_2_02CFFC18
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_02CF6D43		20_2_02CF6D43
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FFC5F8		20_2_05FFC5F8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FFA130		20_2_05FFA130
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FFD358		20_2_05FFD358
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FF0930		20_2_05FF0930
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FF0040		20_2_05FF0040
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FF2A40		20_2_05FF2A40
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B7D4E8		20_2_06B7D4E8
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B78840		20_2_06B78840
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B727F6		20_2_06B727F6
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B723C0		20_2_06B723C0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B73730		20_2_06B73730
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B7249F		20_2_06B7249F
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B7D484		20_2_06B7D484
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B724E7		20_2_06B724E7
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B730D0		20_2_06B730D0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B72549		20_2_06B72549
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B75EB8		20_2_06B75EB8

Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCassa.dll< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.309368123.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000000.246208925.00000000009EE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.325190197.00000000077C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.308207563.0000000003CA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000000.301859609.0000000000438000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8346f821-5c18-4573-9308-3a6383bed95e.exe4 vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.512831125.0000000000F38000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SHIPMENT DOCUMENTS.exe
Source: SHIPMENT DOCUMENTS.exe	Binary or memory string: OriginalFilenamewv6MCeq.exeH vs SHIPMENT DOCUMENTS.exe

Source: SHIPMENT DOCUMENTS.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cnWCiicEpxW.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SHIPMENT DOCUMENTS.exe	Virustotal: Detection: 36%
Source: SHIPMENT DOCUMENTS.exe	ReversingLabs: Detection: 32%

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File read: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Jump to behavior

Source: SHIPMENT DOCUMENTS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmpC7C9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe {path}
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process created: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe {path}			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmpC7C9.tmp			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe {path}			Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe

Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File created: C:\Users\user\AppData\Local\Temp\tmp2A80.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/7@6/3

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: SHIPMENT DOCUMENTS.exe, 00000014.00000002.533082657.0000000003197000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 0000001B.00000002.533894309.00000000033A5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SHIPMENT DOCUMENTS.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_01
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Mutant created: \Sessions\1\BaseNamedObjects\SjgFZewpp
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1632:120:WilError_01

Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/f2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/f2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SHIPMENT DOCUMENTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SHIPMENT DOCUMENTS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SHIPMENT DOCUMENTS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: wv6MCeq.pdb source: SHIPMENT DOCUMENTS.exe, cnWCiicEpxW.exe.0.dr

Data Obfuscation

Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	.Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	.Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	.Net Code: NLQjT5EheN System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_05FF9308 push FFFFFF8Eh; iretd		20_2_05FF930C
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B73730 push es; iretd		20_2_06B744B0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B73730 push es; iretd		20_2_06B74548
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B73730 push es; iretd		20_2_06B745E0
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Code function: 20_2_06B73730 push es; retf B740h		20_2_06B746F4

Source: initial sample	Static PE information: section name: .text entropy: 7.505864996836325
Source: initial sample	Static PE information: section name: .text entropy: 7.505864996836325

Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	High entropy of concatenated method names: '.cctor', 'QyVAiFQXUMZNF', 'nrlBdwomul', 'qZYBsin8PU', 'KAFBokh5nO', 'RQABMSq4Rp', 'n1wBxskWtA', 'EayBA3cOvR', 'EQLB1FRk1a', 'sBZB4RFpgY'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/fRes4fpy4RpLUhyAi8.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'aoajPGGDsy', 'hp7gJ2SG99', 'YlXgNqNV92', 'ShJgZNmYte', 'V5FguwXIpP', 'AccgWWdBto', 'dlPg9Onwjy', 'Y9cgoPBKT4'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/nUXdDFvBAxd7UyEdwu.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'wvHvP3hj8P', 'JUEgs0GjTP', 'rsGgCmkLkM', 'kUIgtAyTSy', 'jLVgUPfcNM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/hg860IXTVynHirxdTO.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'yHPv7bBIPH', 'kUIgtAyTSy', 'jLVgUPfcNM', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/poopYPE0sHxymQfoHf.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'EQDWadX3F4', 'hp7gJ2SG99', 'YlXgNqNV92', 'e5UOtnnHAr', 'JAlOUgsCnU', 'TovOiJRdNK', 'SSMODoqyQS', 'ui2Okw6Hdb'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/M1Lgw25sFV1h7SPnbi.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'm0WIhK8QiV', 'kUIgtAyTSy', 'jLVgUPfcNM', 'QZTlW8PLsG', 'wsll9k5vYj', 'CikllggbKD', 'uDJlpDhb9w', 'XqKlgSM0Ku'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/yhxL5gnBtYUFRLosDJ.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'nsVW18YwIQ', 'JUEgs0GjTP', 'rsGgCmkLkM', 'v5AgMtdIqt', 'Y5Ig20u0b5', 'a8NgiMIdRN', 'kKggDyvo6l', 't66gICG2nM'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/F8m8MfBnBsxD9J6mrM.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'iWYI1I0E2F', 'JUEgs0GjTP', 'rsGgCmkLkM', 'obeO4qj1Pw', 'OXDOTEmSDM', 'b0klvedo5x', 'OJylGKIGJr', 'UDGOs8fXXR'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/VAZPILaYygsjOwTXV7.cs	High entropy of concatenated method names: '.ctor', 'Dispose', 'qb2qk6j6e', 'WTNKhKJWKf', 'uAeKxSM7G6', 'DfnKSsXgLT', 'oFEKm7CYOT', 'bExKas7caH', 'qFmKA4iXNn', 'pwvKF8fvEX'
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/BiGykUAwkcHjngJunl.cs	High entropy of concatenated method names: '.ctor', 'PFcjjPniVb', 'GKAjvqIFPE', 'zPKjWLXew4', 'nrRjIH62AE', 'c3JjBXCu0A', 'S4rjeqyZLl', 'A9ajbrB7yW', 'Dispose', 'I66jgx55If'

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

File created: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cnWCiicEpxW" /XML "C:\Users\user\AppData\Local\Temp\tmp2A80.tmp

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Source: Yara match

File source: Process Memory Space: SHIPMENT DOCUMENTS.exe PID: 3192, type: MEMORYSTR

Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SHIPMENT DOCUMENTS.exe, 00000000.00000002.305232047.0000000002CA1000.00000004.00000800.00020000.00000000.sdmp, cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 3180	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 2356	Thread sleep count: 9568 > 30			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -12912720851596678s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -100000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99887s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99759s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99635s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99515s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99296s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99186s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -99077s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98859s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98747s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98624s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98510s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98380s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -98203s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97732s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97608s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97484s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97364s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97203s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -97062s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -96922s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -96578s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -96452s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -96310s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -96109s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -95968s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -95832s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -95715s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -95562s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -94406s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -93250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -93062s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -91250s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -91000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90843s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90684s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90562s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90452s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90343s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90202s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -90078s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89945s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89827s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89703s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89589s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89466s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe TID: 5876	Thread sleep time: -89356s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 2968	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 5972	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -12912720851596678s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -100000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 3536	Thread sleep count: 9400 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99859s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99703s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99588s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99485s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99344s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99234s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -99105s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98981s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98793s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98670s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98562s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98452s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98328s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98198s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -98004s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97860s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97718s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97609s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97500s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97390s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97281s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97172s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -97058s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -96920s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe TID: 6080	Thread sleep time: -96808s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Window / User API: threadDelayed 9568			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Window / User API: threadDelayed 9400			Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 100000			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99887			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99759			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99635			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99515			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99406			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99296			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99186			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 99077			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98968			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98859			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98747			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98624			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98510			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98380			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 98203			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97732			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97608			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97484			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97364			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97203			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 97062			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 96922			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 96578			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 96452			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 96310			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 96109			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 95968			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 95832			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 95715			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 95562			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 94406			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 93250			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 93062			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 91250			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 91000			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90843			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90684			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90562			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90452			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90343			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90202			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 90078			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89945			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89827			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89703			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89589			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89466			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Thread delayed: delay time: 89356			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 100000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99859			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99703			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99588			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99485			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99344			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99234			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 99105			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98981			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98793			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98670			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98562			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98452			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98328			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98198			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 98004			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97860			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97718			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97609			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97500			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97390			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97281			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97172			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 97058			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 96920			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cnWCiicEpxW.exe	Thread delayed: delay time: 96808			Jump to behavior

Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.397543098.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.546575639.000000000660D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396165041.000000000660E000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000002.518569851.00000000010E0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.400776216.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.396428303.0000000006606000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.408594188.000000000660D000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.397431025.000000000660B000.00000004.00000800.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.397802691.000000000660B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: cnWCiicEpxW.exe, 00000015.00000002.415707967.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: cnWCiicEpxW.exe, 0000001B.00000003.494475191.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SHIPMENT DOCUMENTS.exe, 00000014.00000003.393067640.00000000010F0000.00000004.00000020.00020000.00000000.sdmp, SHIPMENT DOCUMENTS.exe, 00000014.00000003.387644774.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll__

Anti Debugging

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SHIPMENT DOCUMENTS.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Source: SHIPMENT DOCUMENTS.exe, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: cnWCiicEpxW.exe.0.dr, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: 0.0.SHIPMENT DOCUMENTS.exe.910000.0.unpack, u8Kw867S61naurO56Y/I7QTkd9Ynf3eywmg2Z.cs	Reference to suspicious API methods: ('LU7BJiCwx1', 'GetProcAddress@kernel32'), ('I49BKhrl98', 'LoadLibrary@kernel32')
Source: 20.0.SHIPMENT DOCUMENTS.exe.400000.0.unpack, A/C1.cs