Windows Analysis Report
SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Analysis ID: 1416971
MD5: b1f42dab84b254f5595d45fd7282496f
SHA1: 71af03e51bbdded888dbb714c67c38809802a1c0
SHA256: d0dcfea187c2da840bfeba21de0b50952c97dc101065a93d94909e2975bfe558
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Outbound SMTP Connections
Tries to load missing DLLs
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Avira: detection malicious, Label: HEUR/AGEN.1307376
Found malware configuration
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.sintecno.gr", "Username": "info@sintecno.gr", "Password": "k$&v8@,q0Pf#"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Virustotal: Detection: 39% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Virustotal: Detection: 39% Perma Link
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe ReversingLabs: Detection: 39%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Joe Sandbox ML: detected

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.630000.0.unpack
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then push dword ptr [ebp-24h] 0_2_082AF280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 0_2_082AF280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 0_2_082A6294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then xor edx, edx 0_2_082AF1B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then push dword ptr [ebp-20h] 0_2_082AEF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 0_2_082AEF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 4x nop then jmp 0994C1A6h 0_2_0994C89C
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 4_2_09136294
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then push dword ptr [ebp-24h] 4_2_0913F280
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 4_2_0913F280
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then xor edx, edx 4_2_0913F1B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then push dword ptr [ebp-20h] 4_2_0913EF60
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 4_2_0913EF60
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then jmp 0942C1A6h 4_2_0942C89C
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then push dword ptr [ebp-24h] 8_2_090FF280
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 8_2_090FF280
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 8_2_090F6294
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then xor edx, edx 8_2_090FF1B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then push dword ptr [ebp-20h] 8_2_090FEF60
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh 8_2_090FEF60
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then jmp 0935C1F6h 8_2_0935C8EC
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 89.117.152.28:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LRTC-ASLT LRTC-ASLT
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 89.117.152.28:587
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.000000000297C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002994000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002B85000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002AFB000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1937590488.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.0000000002A3C000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.0000000002A54000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.sintecno.gr
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002901000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1937590488.0000000003441000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.00000000029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cUsRDu.exe, 00000008.00000002.1956021719.000000000276A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1723920785.00000000093F2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000004.00000002.1878987635.000000000426E000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1935156282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cUsRDu.exe, 00000008.00000002.1958663294.00000000041C5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002901000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000004.00000002.1878987635.000000000426E000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1937590488.0000000003441000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1935156282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cUsRDu.exe, 00000008.00000002.1958663294.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.00000000029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002901000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1937590488.0000000003441000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.00000000029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4119150996.0000000002901000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.1937590488.0000000003441000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4119810929.00000000029CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49743 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, NDL2m67zO.cs .Net Code: Nnak
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, NDL2m67zO.cs .Net Code: Nnak
Installs a global keyboard hook
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window created: window name: CLIPBRDWNDCLASS

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.41c5a30.3.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4200a50.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.cUsRDu.exe.42a9570.9.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.cUsRDu.exe.426e550.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4200a50.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.cUsRDu.exe.42a9570.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.cUsRDu.exe.426e550.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.41c5a30.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA13E8 0_2_00FA13E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA2648 0_2_00FA2648
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA1C30 0_2_00FA1C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA5220 0_2_00FA5220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA43D0 0_2_00FA43D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA43C1 0_2_00FA43C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA1340 0_2_00FA1340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA3409 0_2_00FA3409
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA55A0 0_2_00FA55A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA5591 0_2_00FA5591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA57C0 0_2_00FA57C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA57B0 0_2_00FA57B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA0871 0_2_00FA0871
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA3990 0_2_00FA3990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA5A68 0_2_00FA5A68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA5A59 0_2_00FA5A59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_00FA5C38 0_2_00FA5C38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A5590 0_2_082A5590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A3EA0 0_2_082A3EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082AF960 0_2_082AF960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A62A0 0_2_082A62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A62B0 0_2_082A62B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A6537 0_2_082A6537
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082AD510 0_2_082AD510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A6548 0_2_082A6548
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A5580 0_2_082A5580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09944978 0_2_09944978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_0994DC40 0_2_0994DC40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09944970 0_2_09944970
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09947960 0_2_09947960
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09949B48 0_2_09949B48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09947D98 0_2_09947D98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09947D89 0_2_09947D89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_0994EF28 0_2_0994EF28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09940E90 0_2_09940E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09940E89 0_2_09940E89
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_0994A0A8 0_2_0994A0A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09940040 0_2_09940040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_09947528 0_2_09947528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_027141F8 3_2_027141F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_02714AC8 3_2_02714AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_0271EB11 3_2_0271EB11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_0271A990 3_2_0271A990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_02713EB0 3_2_02713EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_0271ADE0 3_2_0271ADE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C3440 3_2_066C3440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C7D40 3_2_066C7D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C65C0 3_2_066C65C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C5580 3_2_066C5580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066CB1E0 3_2_066CB1E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C7660 3_2_066C7660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C5CB3 3_2_066C5CB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066CE348 3_2_066CE348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C0040 3_2_066C0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_067BECE8 3_2_067BECE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_067B1DC8 3_2_067B1DC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_067B1DBA 3_2_067B1DBA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_066C0007 3_2_066C0007
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024113E8 4_2_024113E8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02412648 4_2_02412648
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02411C30 4_2_02411C30
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02415A59 4_2_02415A59
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02415A68 4_2_02415A68
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02415220 4_2_02415220
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02411340 4_2_02411340
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024143C1 4_2_024143C1
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024143D0 4_2_024143D0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0241F3B8 4_2_0241F3B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02410873 4_2_02410873
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02413990 4_2_02413990
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024157C0 4_2_024157C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024157B1 4_2_024157B1
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02413409 4_2_02413409
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02415C38 4_2_02415C38
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_02415591 4_2_02415591
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_024155A0 4_2_024155A0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D85A80 4_2_07D85A80
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D86EB0 4_2_07D86EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D86EAF 4_2_07D86EAF
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D87A4F 4_2_07D87A4F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D8E058 4_2_07D8E058
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D8F848 4_2_07D8F848
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D8E068 4_2_07D8E068
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_07D8F839 4_2_07D8F839
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09135580 4_2_09135580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09133EA0 4_2_09133EA0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0913F960 4_2_0913F960
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_091362B0 4_2_091362B0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_091362A0 4_2_091362A0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0913D510 4_2_0913D510
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09136537 4_2_09136537
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09424978 4_2_09424978
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0942DC50 4_2_0942DC50
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09427960 4_2_09427960
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09424968 4_2_09424968
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09429B48 4_2_09429B48
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09427D88 4_2_09427D88
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09427D98 4_2_09427D98
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0942EF28 4_2_0942EF28
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09420E90 4_2_09420E90
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09420040 4_2_09420040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_0942A0A8 4_2_0942A0A8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09427528 4_2_09427528
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A4E6DD 7_2_01A4E6DD
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A44AC8 7_2_01A44AC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A4ACC0 7_2_01A4ACC0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A43EB0 7_2_01A43EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A441F8 7_2_01A441F8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC3440 7_2_06FC3440
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC65C0 7_2_06FC65C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC5580 7_2_06FC5580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FCB1E0 7_2_06FCB1E0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC7D40 7_2_06FC7D40
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC7660 7_2_06FC7660
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FCE348 7_2_06FCE348
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC0040 7_2_06FC0040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC5CB3 7_2_06FC5CB3
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_06FC0006 7_2_06FC0006
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D913E8 8_2_00D913E8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D92648 8_2_00D92648
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D91C30 8_2_00D91C30
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D95220 8_2_00D95220
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D943D0 8_2_00D943D0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D943C1 8_2_00D943C1
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D9F3B8 8_2_00D9F3B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D913B8 8_2_00D913B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D91375 8_2_00D91375
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D93409 8_2_00D93409
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D95591 8_2_00D95591
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D955A0 8_2_00D955A0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D957C0 8_2_00D957C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D957B1 8_2_00D957B1
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D90872 8_2_00D90872
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D93990 8_2_00D93990
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D95A59 8_2_00D95A59
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D95A68 8_2_00D95A68
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_00D95C38 8_2_00D95C38
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F5580 8_2_090F5580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F3EA0 8_2_090F3EA0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090FF960 8_2_090FF960
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F62A0 8_2_090F62A0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F62B0 8_2_090F62B0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090FD510 8_2_090FD510
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F6537 8_2_090F6537
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09354978 8_2_09354978
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_0935DB18 8_2_0935DB18
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_0935FB58 8_2_0935FB58
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09357960 8_2_09357960
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09354968 8_2_09354968
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09359B48 8_2_09359B48
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09357D98 8_2_09357D98
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09357D89 8_2_09357D89
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09350E90 8_2_09350E90
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09350040 8_2_09350040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_0935A0A8 8_2_0935A0A8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09357528 8_2_09357528
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095D5A80 8_2_095D5A80
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095DE058 8_2_095DE058
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095DF848 8_2_095DF848
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095DE068 8_2_095DE068
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095DF839 8_2_095DF839
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095D7A7A 8_2_095D7A7A
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095D6EB0 8_2_095D6EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_095D6EAE 8_2_095D6EAE
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_028241F8 13_2_028241F8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_02824AC8 13_2_02824AC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_0282E997 13_2_0282E997
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_02823EB0 13_2_02823EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_0282ACD0 13_2_0282ACD0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F3440 13_2_065F3440
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F7D40 13_2_065F7D40
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F65C0 13_2_065F65C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F5580 13_2_065F5580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065FB1F0 13_2_065FB1F0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F7660 13_2_065F7660
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F5CC8 13_2_065F5CC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065FE348 13_2_065FE348
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F0040 13_2_065F0040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_066E1DC8 13_2_066E1DC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_066E1DC2 13_2_066E1DC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_065F003E 13_2_065F003E
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d39206-a055-4a9d-b91e-5d355807eddd.exe4 vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000000.1662088617.0000000000700000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameDCDV.exeD vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1718259177.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1718789627.0000000002D48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d39206-a055-4a9d-b91e-5d355807eddd.exe4 vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1719669646.00000000043BE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000000.00000002.1724871932.0000000009C50000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4147516174.0000000006422000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDCDV.exeD vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4113929398.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Binary or memory string: OriginalFilenameDCDV.exeD vs SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.41c5a30.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4200a50.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.cUsRDu.exe.42a9570.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.cUsRDu.exe.426e550.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4200a50.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.cUsRDu.exe.42a9570.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.cUsRDu.exe.426e550.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.41c5a30.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, OTWUo99bfyR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, OTWUo99bfyR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, Ui9qhZiA7.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, Ui9qhZiA7.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, CuEFPoVIjy5HPw9g3j.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, i10Ca8i0s9wD5Iq89c.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, i10Ca8i0s9wD5Iq89c.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, i10Ca8i0s9wD5Iq89c.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.98d0000.11.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a87a38.4.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a68860.5.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@17/4@2/2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.log Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Mutant created: \Sessions\1\BaseNamedObjects\iHjaGHNGfUgprPsuTWfHXxLfI
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Virustotal: Detection: 39%
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.630000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Unpacked PE file: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.630000.0.unpack
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, CuEFPoVIjy5HPw9g3j.cs .Net Code: yR3HXOFDYw System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, CuEFPoVIjy5HPw9g3j.cs .Net Code: yR3HXOFDYw System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, CuEFPoVIjy5HPw9g3j.cs .Net Code: yR3HXOFDYw System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: 0x843127B4 [Thu Apr 12 03:25:40 2040 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 0_2_082A9B4C push cs; retf 0_2_082A9B4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_02710C3D push edi; ret 3_2_02710CC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Code function: 3_2_067B1658 push cs; retf 3_2_067B165B
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4_2_09139B4C push cs; retf 4_2_09139B4F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A4A298 push esp; ret 7_2_01A4A299
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_01A40C3D push edi; ret 7_2_01A40CC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_090F9B4C push cs; retf 8_2_090F9B4F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_0282A298 push esp; ret 13_2_0282A299
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_02820C3D push edi; ret 13_2_02820CC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_066E8C42 push es; ret 13_2_066E8C5C
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 13_2_066E1658 push cs; retf 13_2_066E165B
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Static PE information: section name: .text entropy: 7.7863804272698935
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, JSRoflHVIu1VIM2XZy.cs High entropy of concatenated method names: 'NiFOwWL4G7', 'xI2OK21kou', 'm6BOHqla8G', 'OFUOfGpBSS', 'W5TOtFxkCW', 'VVbOsEZtsw', 'tp5OgdeAQX', 'l11rdK9O6U', 'tBUrMcuEIW', 'IwWrxk34vp'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, kxCVgRsLU82TWtXhTua.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'L1RUAXBcIW', 'C2rUpGsh74', 'KhVU82wY6X', 'ugRUC7UWDa', 'JAaUPMOaQl', 'tSKUFcAKdp', 'OvIUd02VgP'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, hwTImO5wIZdt1LsJEl.cs High entropy of concatenated method names: 'sjxgS445yg', 'BgSgt3UvFu', 'F1ZgsBKGbF', 'PNJgD3gyYQ', 'qDYgWybnj8', 'YHWsPB1QqR', 'JBFsFJVqhP', 'lTTsdJ4AVW', 'XHysMW9Yh3', 'DW2sxuRlDZ'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, ttroY30nKeoMRTs4mw.cs High entropy of concatenated method names: 'ilEDV9n0VX', 'jl9D0psko5', 'csnDXZth5O', 'RiCDZcB9UB', 'QaOD7q9MFr', 'ItyD53AaEE', 'VOGDlVPOTU', 'QA0D2Glsvo', 'PoeD9edahQ', 'rhMDRMx25b'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, BpdoLoho4JbyfTcYHZ.cs High entropy of concatenated method names: 'Y0pXNuXRI', 'nF6Z18kU0', 'pVJ5nCyqi', 'cuNlYUkNO', 'obM9fOGbG', 'LAERWK0a2', 'Ex5Ionxl90FG2WyLi3', 'hfphKnY3j1UcfGZ0u9', 'qFJrVVbvn', 's1hUpBPYO'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, Q5qFa47b5WUxjm6WwM.cs High entropy of concatenated method names: 'IWLh3jluQn', 'ouxhN06d6Q', 'ToString', 'F8Bhflbpu6', 'y4FhtWvZah', 'AlvhkhSotR', 'QNwhsT02fD', 'zDyhgRC9Gl', 'MRchDr6Dkf', 'JIfhWIK35W'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, svqfi0GdSWWEpOeLOK.cs High entropy of concatenated method names: 'HGvj2WeSF0', 'YuVj9neM2h', 'AhpjnC0J4m', 'SfAjQv2tVt', 'VZZjcuNYK3', 'YUXjqko06y', 'yBMjeeJTnF', 'mVdj6qCr25', 'virjabpNKC', 'aKRjvnMawr'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, iNf0xazAudhV9tUVU0.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IgYOjVd5m3', 'zwPOL3YBU3', 'QpsOBfOQFr', 'dOxOhArMaj', 'ePvOrNuTOi', 'Gk3OOEnCVk', 'DbOOUWcZxw'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, GIm9LcBCio7heeAIKG.cs High entropy of concatenated method names: 'ToString', 'H7jBvL6Orc', 'fkUBQjRnHp', 'h13By2UEmC', 'TNGBcpC1yR', 'nn1BqWo9ah', 'G0AB1lEnjk', 'kCKBetJX9e', 'XbvB6ZJ09u', 'mTaB4bKHGd'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, i10Ca8i0s9wD5Iq89c.cs High entropy of concatenated method names: 'mMctA9jrid', 'I3ctp00B8m', 'Ya6t8c6wqK', 'Hi7tCZ5KGS', 'rINtPM2qG5', 'BoKtF2N4nN', 'v7StdORmQf', 'TrxtMvH8tC', 'iuntx5lvhw', 'H0StmfMux2'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, Y269d7ssTpvHKCBnN3v.cs High entropy of concatenated method names: 'ToString', 'E2mUKltuLj', 'k2KUHM65Ft', 'cTCUSSe0u3', 'hdXUf0WkRl', 'jEdUtsAvGW', 'aZOUk4p21s', 'q0mUsM1Qu1', 'UcAV4Zc8Y9m7uyjPaQM', 'EYhoDScvWgN0uK3bCyc'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, MZRLv1vxOC9JyF48pk.cs High entropy of concatenated method names: 'T9qhMTvLKe', 'em0hmfnHuG', 'm0QruyfiwK', 'U9erwID5Rw', 'h6UhvDXEk9', 'AnKhGwHr1i', 'WDqhTM4kJe', 'cLGhATj3Zj', 'UAihpVGVuC', 'adFh8gcraN'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, JvxCf5878yTDX26kQ1.cs High entropy of concatenated method names: 'H1Jrnhi5YH', 'fEorQfn12r', 'd2aryrdBgM', 'W3DrcpJZjn', 'vRGrAcodGU', 'JCkrqwPxGj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, bKvdEGAP50yOYBGc7p.cs High entropy of concatenated method names: 'hABkZByHWs', 'JXuk5fJaEP', 'EdXk2q0hp6', 'rSvk9T9sBY', 'uP7kLsdw5j', 'UKtkBSOrHO', 'TZHkhO7GnX', 'gtskr5ccrj', 'lrUkO0uNXQ', 'Of0kUasaQK'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, oRXyGYPPEVE6M6fUUt.cs High entropy of concatenated method names: 'PuYrfJDjR4', 'oIErtBtywB', 'WZarkc92Fr', 'lSersZnyiv', 'v1PrgP0oLt', 'R1YrDUD7m5', 'hxZrWfYEo5', 'dKjrYdhEse', 'Xh8r3Yk4K6', 'mbArNG2ij0'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, hWN02KcIE6epDw57PS.cs High entropy of concatenated method names: 'ISKs7lJFX6', 'u9VslGoRcB', 'hfKkyPYPmj', 'Wq0kce1Vqa', 'HiIkqIG1FC', 'KBak1nsrdF', 'iTVkeULX8v', 'D0ak6O5VNb', 'IdUk45pA9q', 'IfikaCMNSI'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, GE7KF11ItV9IXM6xJc.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'beEbxvNLk7', 'gkFbmdQOcI', 'Rw0bz799n6', 'se2Ku440sM', 'UMBKwsVhxT', 'fjDKbrRSvZ', 'CiPKKPvW8j', 'EoAtjBAcdceiUJFqlgE'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, BPr8wFbQgE2UxRZt3I.cs High entropy of concatenated method names: 'S0KwDFVh9J', 'OcxwWItVrp', 'rh7w3dFsAd', 'Ye8wNNEgNy', 'MTYwLLWT1x', 'UsOwBNK6cZ', 'ErWt1E6GT3bVjtjhnk', 'pkeBmnbRE8JmqEFSRb', 'uaCwwgFeEp', 'Fd3wKgu1rn'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, uQxJlDem3MIhT8LGYF.cs High entropy of concatenated method names: 'BfpDfR4oVM', 'i67DkioWTL', 'SaSDgginrD', 'TgsgmTmwpc', 'lDugzjPrIw', 'jt1DuBQQ15', 'gnJDwevcGP', 'v8qDbt7y0x', 'ASyDKY1GWa', 'J6pDH3mhqs'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, JmndxxuSGUkIXOmnem.cs High entropy of concatenated method names: 'Dispose', 'on0wx2x0Il', 'tnMbQnQwkP', 'alqIIwq4cy', 'Uygwmhye8j', 'Ti3wz2sWj8', 'ProcessDialogKey', 'uwobujpNSu', 'HmMbwus8Q1', 'QBDbbBoT7n'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, Uul71CtVLAbELcpQtP.cs High entropy of concatenated method names: 'Hd5LaZCtBv', 'sLLLG4hupO', 'IKmLAPTx93', 'HSgLpFFKnk', 'cAlLQcL21e', 'uArLyqGrtI', 'CXMLcBq6sD', 'D7cLqpZGLB', 'A9hL1lMv97', 'ykLLerbw6y'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, SMgjG2swe0Z42bb6Y5E.cs High entropy of concatenated method names: 'f8LOVrT9Kp', 'Dk2O0t9Bii', 'e1LOXTRDL4', 'BYpOZ7HMfv', 'iMsO7O6P0D', 'pG0O58cPkC', 'l7cOlXI1hl', 'vlkO2QyLNQ', 'lPNO9IctNd', 'x6pORinP7Z'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.45c6930.7.raw.unpack, CuEFPoVIjy5HPw9g3j.cs High entropy of concatenated method names: 'P27KSZK8kd', 'OlvKfuu9xi', 'wW3Kt1MGQh', 'bfOKkL1iLU', 'HH4KsBXHJq', 'xhNKgPIT1W', 'iIXKDlu4b8', 'FYTKWhJ2SJ', 'RfFKYweyJM', 'UxrK3sljfx'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, JSRoflHVIu1VIM2XZy.cs High entropy of concatenated method names: 'NiFOwWL4G7', 'xI2OK21kou', 'm6BOHqla8G', 'OFUOfGpBSS', 'W5TOtFxkCW', 'VVbOsEZtsw', 'tp5OgdeAQX', 'l11rdK9O6U', 'tBUrMcuEIW', 'IwWrxk34vp'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, kxCVgRsLU82TWtXhTua.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'L1RUAXBcIW', 'C2rUpGsh74', 'KhVU82wY6X', 'ugRUC7UWDa', 'JAaUPMOaQl', 'tSKUFcAKdp', 'OvIUd02VgP'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, hwTImO5wIZdt1LsJEl.cs High entropy of concatenated method names: 'sjxgS445yg', 'BgSgt3UvFu', 'F1ZgsBKGbF', 'PNJgD3gyYQ', 'qDYgWybnj8', 'YHWsPB1QqR', 'JBFsFJVqhP', 'lTTsdJ4AVW', 'XHysMW9Yh3', 'DW2sxuRlDZ'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, ttroY30nKeoMRTs4mw.cs High entropy of concatenated method names: 'ilEDV9n0VX', 'jl9D0psko5', 'csnDXZth5O', 'RiCDZcB9UB', 'QaOD7q9MFr', 'ItyD53AaEE', 'VOGDlVPOTU', 'QA0D2Glsvo', 'PoeD9edahQ', 'rhMDRMx25b'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, BpdoLoho4JbyfTcYHZ.cs High entropy of concatenated method names: 'Y0pXNuXRI', 'nF6Z18kU0', 'pVJ5nCyqi', 'cuNlYUkNO', 'obM9fOGbG', 'LAERWK0a2', 'Ex5Ionxl90FG2WyLi3', 'hfphKnY3j1UcfGZ0u9', 'qFJrVVbvn', 's1hUpBPYO'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, Q5qFa47b5WUxjm6WwM.cs High entropy of concatenated method names: 'IWLh3jluQn', 'ouxhN06d6Q', 'ToString', 'F8Bhflbpu6', 'y4FhtWvZah', 'AlvhkhSotR', 'QNwhsT02fD', 'zDyhgRC9Gl', 'MRchDr6Dkf', 'JIfhWIK35W'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, svqfi0GdSWWEpOeLOK.cs High entropy of concatenated method names: 'HGvj2WeSF0', 'YuVj9neM2h', 'AhpjnC0J4m', 'SfAjQv2tVt', 'VZZjcuNYK3', 'YUXjqko06y', 'yBMjeeJTnF', 'mVdj6qCr25', 'virjabpNKC', 'aKRjvnMawr'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, iNf0xazAudhV9tUVU0.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IgYOjVd5m3', 'zwPOL3YBU3', 'QpsOBfOQFr', 'dOxOhArMaj', 'ePvOrNuTOi', 'Gk3OOEnCVk', 'DbOOUWcZxw'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, GIm9LcBCio7heeAIKG.cs High entropy of concatenated method names: 'ToString', 'H7jBvL6Orc', 'fkUBQjRnHp', 'h13By2UEmC', 'TNGBcpC1yR', 'nn1BqWo9ah', 'G0AB1lEnjk', 'kCKBetJX9e', 'XbvB6ZJ09u', 'mTaB4bKHGd'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, i10Ca8i0s9wD5Iq89c.cs High entropy of concatenated method names: 'mMctA9jrid', 'I3ctp00B8m', 'Ya6t8c6wqK', 'Hi7tCZ5KGS', 'rINtPM2qG5', 'BoKtF2N4nN', 'v7StdORmQf', 'TrxtMvH8tC', 'iuntx5lvhw', 'H0StmfMux2'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, Y269d7ssTpvHKCBnN3v.cs High entropy of concatenated method names: 'ToString', 'E2mUKltuLj', 'k2KUHM65Ft', 'cTCUSSe0u3', 'hdXUf0WkRl', 'jEdUtsAvGW', 'aZOUk4p21s', 'q0mUsM1Qu1', 'UcAV4Zc8Y9m7uyjPaQM', 'EYhoDScvWgN0uK3bCyc'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, MZRLv1vxOC9JyF48pk.cs High entropy of concatenated method names: 'T9qhMTvLKe', 'em0hmfnHuG', 'm0QruyfiwK', 'U9erwID5Rw', 'h6UhvDXEk9', 'AnKhGwHr1i', 'WDqhTM4kJe', 'cLGhATj3Zj', 'UAihpVGVuC', 'adFh8gcraN'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, JvxCf5878yTDX26kQ1.cs High entropy of concatenated method names: 'H1Jrnhi5YH', 'fEorQfn12r', 'd2aryrdBgM', 'W3DrcpJZjn', 'vRGrAcodGU', 'JCkrqwPxGj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, bKvdEGAP50yOYBGc7p.cs High entropy of concatenated method names: 'hABkZByHWs', 'JXuk5fJaEP', 'EdXk2q0hp6', 'rSvk9T9sBY', 'uP7kLsdw5j', 'UKtkBSOrHO', 'TZHkhO7GnX', 'gtskr5ccrj', 'lrUkO0uNXQ', 'Of0kUasaQK'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, oRXyGYPPEVE6M6fUUt.cs High entropy of concatenated method names: 'PuYrfJDjR4', 'oIErtBtywB', 'WZarkc92Fr', 'lSersZnyiv', 'v1PrgP0oLt', 'R1YrDUD7m5', 'hxZrWfYEo5', 'dKjrYdhEse', 'Xh8r3Yk4K6', 'mbArNG2ij0'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, hWN02KcIE6epDw57PS.cs High entropy of concatenated method names: 'ISKs7lJFX6', 'u9VslGoRcB', 'hfKkyPYPmj', 'Wq0kce1Vqa', 'HiIkqIG1FC', 'KBak1nsrdF', 'iTVkeULX8v', 'D0ak6O5VNb', 'IdUk45pA9q', 'IfikaCMNSI'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, GE7KF11ItV9IXM6xJc.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'beEbxvNLk7', 'gkFbmdQOcI', 'Rw0bz799n6', 'se2Ku440sM', 'UMBKwsVhxT', 'fjDKbrRSvZ', 'CiPKKPvW8j', 'EoAtjBAcdceiUJFqlgE'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, BPr8wFbQgE2UxRZt3I.cs High entropy of concatenated method names: 'S0KwDFVh9J', 'OcxwWItVrp', 'rh7w3dFsAd', 'Ye8wNNEgNy', 'MTYwLLWT1x', 'UsOwBNK6cZ', 'ErWt1E6GT3bVjtjhnk', 'pkeBmnbRE8JmqEFSRb', 'uaCwwgFeEp', 'Fd3wKgu1rn'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, uQxJlDem3MIhT8LGYF.cs High entropy of concatenated method names: 'BfpDfR4oVM', 'i67DkioWTL', 'SaSDgginrD', 'TgsgmTmwpc', 'lDugzjPrIw', 'jt1DuBQQ15', 'gnJDwevcGP', 'v8qDbt7y0x', 'ASyDKY1GWa', 'J6pDH3mhqs'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, JmndxxuSGUkIXOmnem.cs High entropy of concatenated method names: 'Dispose', 'on0wx2x0Il', 'tnMbQnQwkP', 'alqIIwq4cy', 'Uygwmhye8j', 'Ti3wz2sWj8', 'ProcessDialogKey', 'uwobujpNSu', 'HmMbwus8Q1', 'QBDbbBoT7n'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, Uul71CtVLAbELcpQtP.cs High entropy of concatenated method names: 'Hd5LaZCtBv', 'sLLLG4hupO', 'IKmLAPTx93', 'HSgLpFFKnk', 'cAlLQcL21e', 'uArLyqGrtI', 'CXMLcBq6sD', 'D7cLqpZGLB', 'A9hL1lMv97', 'ykLLerbw6y'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, SMgjG2swe0Z42bb6Y5E.cs High entropy of concatenated method names: 'f8LOVrT9Kp', 'Dk2O0t9Bii', 'e1LOXTRDL4', 'BYpOZ7HMfv', 'iMsO7O6P0D', 'pG0O58cPkC', 'l7cOlXI1hl', 'vlkO2QyLNQ', 'lPNO9IctNd', 'x6pORinP7Z'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4643150.10.raw.unpack, CuEFPoVIjy5HPw9g3j.cs High entropy of concatenated method names: 'P27KSZK8kd', 'OlvKfuu9xi', 'wW3Kt1MGQh', 'bfOKkL1iLU', 'HH4KsBXHJq', 'xhNKgPIT1W', 'iIXKDlu4b8', 'FYTKWhJ2SJ', 'RfFKYweyJM', 'UxrK3sljfx'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, JSRoflHVIu1VIM2XZy.cs High entropy of concatenated method names: 'NiFOwWL4G7', 'xI2OK21kou', 'm6BOHqla8G', 'OFUOfGpBSS', 'W5TOtFxkCW', 'VVbOsEZtsw', 'tp5OgdeAQX', 'l11rdK9O6U', 'tBUrMcuEIW', 'IwWrxk34vp'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, kxCVgRsLU82TWtXhTua.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'L1RUAXBcIW', 'C2rUpGsh74', 'KhVU82wY6X', 'ugRUC7UWDa', 'JAaUPMOaQl', 'tSKUFcAKdp', 'OvIUd02VgP'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, hwTImO5wIZdt1LsJEl.cs High entropy of concatenated method names: 'sjxgS445yg', 'BgSgt3UvFu', 'F1ZgsBKGbF', 'PNJgD3gyYQ', 'qDYgWybnj8', 'YHWsPB1QqR', 'JBFsFJVqhP', 'lTTsdJ4AVW', 'XHysMW9Yh3', 'DW2sxuRlDZ'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, ttroY30nKeoMRTs4mw.cs High entropy of concatenated method names: 'ilEDV9n0VX', 'jl9D0psko5', 'csnDXZth5O', 'RiCDZcB9UB', 'QaOD7q9MFr', 'ItyD53AaEE', 'VOGDlVPOTU', 'QA0D2Glsvo', 'PoeD9edahQ', 'rhMDRMx25b'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, BpdoLoho4JbyfTcYHZ.cs High entropy of concatenated method names: 'Y0pXNuXRI', 'nF6Z18kU0', 'pVJ5nCyqi', 'cuNlYUkNO', 'obM9fOGbG', 'LAERWK0a2', 'Ex5Ionxl90FG2WyLi3', 'hfphKnY3j1UcfGZ0u9', 'qFJrVVbvn', 's1hUpBPYO'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, Q5qFa47b5WUxjm6WwM.cs High entropy of concatenated method names: 'IWLh3jluQn', 'ouxhN06d6Q', 'ToString', 'F8Bhflbpu6', 'y4FhtWvZah', 'AlvhkhSotR', 'QNwhsT02fD', 'zDyhgRC9Gl', 'MRchDr6Dkf', 'JIfhWIK35W'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, svqfi0GdSWWEpOeLOK.cs High entropy of concatenated method names: 'HGvj2WeSF0', 'YuVj9neM2h', 'AhpjnC0J4m', 'SfAjQv2tVt', 'VZZjcuNYK3', 'YUXjqko06y', 'yBMjeeJTnF', 'mVdj6qCr25', 'virjabpNKC', 'aKRjvnMawr'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, iNf0xazAudhV9tUVU0.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IgYOjVd5m3', 'zwPOL3YBU3', 'QpsOBfOQFr', 'dOxOhArMaj', 'ePvOrNuTOi', 'Gk3OOEnCVk', 'DbOOUWcZxw'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, GIm9LcBCio7heeAIKG.cs High entropy of concatenated method names: 'ToString', 'H7jBvL6Orc', 'fkUBQjRnHp', 'h13By2UEmC', 'TNGBcpC1yR', 'nn1BqWo9ah', 'G0AB1lEnjk', 'kCKBetJX9e', 'XbvB6ZJ09u', 'mTaB4bKHGd'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, i10Ca8i0s9wD5Iq89c.cs High entropy of concatenated method names: 'mMctA9jrid', 'I3ctp00B8m', 'Ya6t8c6wqK', 'Hi7tCZ5KGS', 'rINtPM2qG5', 'BoKtF2N4nN', 'v7StdORmQf', 'TrxtMvH8tC', 'iuntx5lvhw', 'H0StmfMux2'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, Y269d7ssTpvHKCBnN3v.cs High entropy of concatenated method names: 'ToString', 'E2mUKltuLj', 'k2KUHM65Ft', 'cTCUSSe0u3', 'hdXUf0WkRl', 'jEdUtsAvGW', 'aZOUk4p21s', 'q0mUsM1Qu1', 'UcAV4Zc8Y9m7uyjPaQM', 'EYhoDScvWgN0uK3bCyc'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, MZRLv1vxOC9JyF48pk.cs High entropy of concatenated method names: 'T9qhMTvLKe', 'em0hmfnHuG', 'm0QruyfiwK', 'U9erwID5Rw', 'h6UhvDXEk9', 'AnKhGwHr1i', 'WDqhTM4kJe', 'cLGhATj3Zj', 'UAihpVGVuC', 'adFh8gcraN'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, JvxCf5878yTDX26kQ1.cs High entropy of concatenated method names: 'H1Jrnhi5YH', 'fEorQfn12r', 'd2aryrdBgM', 'W3DrcpJZjn', 'vRGrAcodGU', 'JCkrqwPxGj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, bKvdEGAP50yOYBGc7p.cs High entropy of concatenated method names: 'hABkZByHWs', 'JXuk5fJaEP', 'EdXk2q0hp6', 'rSvk9T9sBY', 'uP7kLsdw5j', 'UKtkBSOrHO', 'TZHkhO7GnX', 'gtskr5ccrj', 'lrUkO0uNXQ', 'Of0kUasaQK'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, oRXyGYPPEVE6M6fUUt.cs High entropy of concatenated method names: 'PuYrfJDjR4', 'oIErtBtywB', 'WZarkc92Fr', 'lSersZnyiv', 'v1PrgP0oLt', 'R1YrDUD7m5', 'hxZrWfYEo5', 'dKjrYdhEse', 'Xh8r3Yk4K6', 'mbArNG2ij0'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, hWN02KcIE6epDw57PS.cs High entropy of concatenated method names: 'ISKs7lJFX6', 'u9VslGoRcB', 'hfKkyPYPmj', 'Wq0kce1Vqa', 'HiIkqIG1FC', 'KBak1nsrdF', 'iTVkeULX8v', 'D0ak6O5VNb', 'IdUk45pA9q', 'IfikaCMNSI'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, GE7KF11ItV9IXM6xJc.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'beEbxvNLk7', 'gkFbmdQOcI', 'Rw0bz799n6', 'se2Ku440sM', 'UMBKwsVhxT', 'fjDKbrRSvZ', 'CiPKKPvW8j', 'EoAtjBAcdceiUJFqlgE'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, BPr8wFbQgE2UxRZt3I.cs High entropy of concatenated method names: 'S0KwDFVh9J', 'OcxwWItVrp', 'rh7w3dFsAd', 'Ye8wNNEgNy', 'MTYwLLWT1x', 'UsOwBNK6cZ', 'ErWt1E6GT3bVjtjhnk', 'pkeBmnbRE8JmqEFSRb', 'uaCwwgFeEp', 'Fd3wKgu1rn'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, uQxJlDem3MIhT8LGYF.cs High entropy of concatenated method names: 'BfpDfR4oVM', 'i67DkioWTL', 'SaSDgginrD', 'TgsgmTmwpc', 'lDugzjPrIw', 'jt1DuBQQ15', 'gnJDwevcGP', 'v8qDbt7y0x', 'ASyDKY1GWa', 'J6pDH3mhqs'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, JmndxxuSGUkIXOmnem.cs High entropy of concatenated method names: 'Dispose', 'on0wx2x0Il', 'tnMbQnQwkP', 'alqIIwq4cy', 'Uygwmhye8j', 'Ti3wz2sWj8', 'ProcessDialogKey', 'uwobujpNSu', 'HmMbwus8Q1', 'QBDbbBoT7n'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, Uul71CtVLAbELcpQtP.cs High entropy of concatenated method names: 'Hd5LaZCtBv', 'sLLLG4hupO', 'IKmLAPTx93', 'HSgLpFFKnk', 'cAlLQcL21e', 'uArLyqGrtI', 'CXMLcBq6sD', 'D7cLqpZGLB', 'A9hL1lMv97', 'ykLLerbw6y'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, SMgjG2swe0Z42bb6Y5E.cs High entropy of concatenated method names: 'f8LOVrT9Kp', 'Dk2O0t9Bii', 'e1LOXTRDL4', 'BYpOZ7HMfv', 'iMsO7O6P0D', 'pG0O58cPkC', 'l7cOlXI1hl', 'vlkO2QyLNQ', 'lPNO9IctNd', 'x6pORinP7Z'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9c50000.12.raw.unpack, CuEFPoVIjy5HPw9g3j.cs High entropy of concatenated method names: 'P27KSZK8kd', 'OlvKfuu9xi', 'wW3Kt1MGQh', 'bfOKkL1iLU', 'HH4KsBXHJq', 'xhNKgPIT1W', 'iIXKDlu4b8', 'FYTKWhJ2SJ', 'RfFKYweyJM', 'UxrK3sljfx'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cUsRDu Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cUsRDu Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File opened: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7200, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: FA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 29E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 49E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 5040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 6040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 6170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 7170000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: A110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: B110000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: B5A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: C5A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 26D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 2900000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: 2740000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2530000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4530000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 6E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 97A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: A7A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: AC30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: BC30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 15F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 3440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 19A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2560000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 6E10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 97F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: A7F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4CE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: F70000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 29C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: F70000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Window / User API: threadDelayed 7433 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Window / User API: threadDelayed 2432 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 2586 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 7264 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 3189
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 6665
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6740 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -27670116110564310s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99874s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99765s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99218s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98999s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -98015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97904s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97467s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -97031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -96047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95609s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -95062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -94953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -94824s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -94719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe TID: 6760 Thread sleep time: -94609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7068 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -34126476536362649s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 4596 Thread sleep count: 2586 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99888s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 4596 Thread sleep count: 7264 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99760s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99437s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99328s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99217s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -99000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -98015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97794s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97577s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97250s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -97031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96812s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96593s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96374s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96155s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -96018s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95671s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95449s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -95015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -94906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -94796s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -94687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 2656 Thread sleep time: -94578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7220 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -34126476536362649s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99875s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99546s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99328s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99218s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -99109s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98988s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98859s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98750s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98640s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98530s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98421s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98312s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98203s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -98093s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97982s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97875s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97765s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97656s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97547s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97437s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97328s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97218s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97109s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -97000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96890s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96781s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96671s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96559s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96292s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96187s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -96077s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -95968s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -95855s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -93203s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -93093s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92984s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92875s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92763s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92656s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92547s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92437s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92327s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92218s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92109s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -92000s >= -30000s
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7460 Thread sleep time: -91890s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99874 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99765 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99656 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99218 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98999 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98891 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98781 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98672 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98562 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98453 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98344 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98234 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98125 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 98015 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97904 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97797 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97687 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97578 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97467 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97359 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97250 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97140 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 97031 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96922 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96812 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96703 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96594 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96484 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96375 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96265 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96156 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 96047 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95937 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95828 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95719 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95609 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95500 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95390 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95281 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95172 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 95062 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 94953 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 94824 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 94719 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Thread delayed: delay time: 94609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99888 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99760 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99437 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99328 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99217 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99109 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98125 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98015 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97794 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97687 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97577 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97250 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97140 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97031 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96922 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96812 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96703 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96593 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96484 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96374 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96265 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96155 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96018 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95781 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95671 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95449 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95125 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95015 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94796 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94687 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94578 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99875
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99546
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99328
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99218
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99109
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98988
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98859
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98750
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98640
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98530
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98421
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98312
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98203
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98093
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97982
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97875
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97765
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97656
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97547
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97437
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97328
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97218
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97109
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97000
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96890
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96781
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96671
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96559
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96292
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96187
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96077
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95968
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95855
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93203
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93093
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92984
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92875
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92763
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92656
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92547
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92437
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92327
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92218
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92109
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 92000
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 91890
Source: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe, 00000003.00000002.4114134292.0000000000D43000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll=
Source: cUsRDu.exe, 00000007.00000002.1935867728.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, cUsRDu.exe, 0000000D.00000002.4114091393.0000000000B16000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory written: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory written: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.4119810929.0000000002A3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4119150996.000000000297C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1935156282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1937590488.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1878987635.000000000426E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4119810929.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4119150996.0000000002951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1937590488.0000000003491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1958663294.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 6664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 3624, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 2756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7360, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.cUsRDu.exe.27c2524.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.27c2524.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.259254c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.259254c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1725123103.0000000009FF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1718789627.00000000029EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1956021719.000000000276A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1876838984.000000000253A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Yara detected Credential Stealer
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1935156282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1878987635.000000000426E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4119810929.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4119150996.0000000002951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1937590488.0000000003491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1958663294.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 6664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 3624, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 2756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7360, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4200a50.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.42a9570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.4759110.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.426e550.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.471e0f0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.41c5a30.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.4119810929.0000000002A3C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4119150996.000000000297C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1719669646.000000000471E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1935156282.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1937590488.00000000034BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1878987635.000000000426E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4119810929.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4119150996.0000000002951000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.1937590488.0000000003491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1958663294.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 6664, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe PID: 3624, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 6688, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 2756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7200, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7360, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 8.2.cUsRDu.exe.27c2524.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.27c2524.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.2a4270c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.259254c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe.9ff0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.cUsRDu.exe.259254c.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1725123103.0000000009FF0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1718789627.00000000029EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1956021719.000000000276A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1876838984.000000000253A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1416971 Sample: SecuriteInfo.com.Trojan.Loc... Startdate: 28/03/2024 Architecture: WINDOWS Score: 100 35 mail.sintecno.gr 2->35 37 api.ipify.org 2->37 53 Found malware configuration 2->53 55 Malicious sample detected (through community Yara rule) 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 8 other signatures 2->59 7 SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe 3 2->7         started        10 cUsRDu.exe 3 2->10         started        12 cUsRDu.exe 2 2->12         started        signatures3 process4 signatures5 61 Detected unpacking (changes PE section rights) 7->61 63 Detected unpacking (overwrites its own PE header) 7->63 65 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->65 14 SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe 16 5 7->14         started        19 SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.16964.6395.exe 7->19         started        67 Antivirus detection for dropped file 10->67 69 Multi AV Scanner detection for dropped file 10->69 71 Machine Learning detection for dropped file 10->71 21 cUsRDu.exe 14 2 10->21         started        23 cUsRDu.exe 10->23         started        73 Injects a PE file into a foreign processes 12->73 25 cUsRDu.exe 12->25         started        27 cUsRDu.exe 12->27         started        29 cUsRDu.exe 12->29         started        process6 dnsIp7 39 mail.sintecno.gr 89.117.152.28, 587 LRTC-ASLT Lithuania 14->39 41 api.ipify.org 104.26.12.205, 443, 49732, 49739 CLOUDFLARENETUS United States 14->41 31 C:\Users\user\AppData\Roaming\...\cUsRDu.exe, PE32 14->31 dropped 33 C:\Users\user\...\cUsRDu.exe:Zone.Identifier, ASCII 14->33 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->43 45 Tries to steal Mail credentials (via file / registry access) 14->45 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->47 49 Tries to harvest and steal browser information (history, passwords, etc) 25->49 51 Installs a global keyboard hook 25->51 file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.26.12.205
 api.ipify.org United States
13335 CLOUDFLARENETUS false
89.117.152.28
 mail.sintecno.gr Lithuania
15419 LRTC-ASLT true

Contacted Domains

Name IP Active
api.ipify.org 104.26.12.205 true
mail.sintecno.gr 89.117.152.28 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high