Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Analysis ID: 1417373
MD5: 2d216a9b8b54b031ab67a1d929646603
SHA1: a175fa05d0f4d4c83cb243f48f3ff2ee30ec2af7
SHA256: fbad66e0031f03c7f1ad457e3fc929c1259f236c938c5d7c70f8e77320d7d8b9
Tags: exe
Infos:

Detection

AgentTesla, PureLog Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected PureLog Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to log keystrokes (.Net Source)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Suspicious Outbound SMTP Connections
Tries to load missing DLLs
Uses 32bit PE files
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Avira: detection malicious, Label: HEUR/AGEN.1305445
Found malware configuration
Source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.sintecno.gr", "Username": "info@sintecno.gr", "Password": "k$&v8@,q0Pf#"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Virustotal: Detection: 58% Perma Link
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Virustotal: Detection: 50% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Joe Sandbox ML: detected

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.190000.0.unpack
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4x nop then jmp 08C45F48h 0_2_08C45486
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then jmp 048C5F48h 5_2_048C5486
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 4x nop then jmp 09BF5F48h 8_2_09BF5486
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 89.117.152.28:587
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.26.12.205 104.26.12.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LRTC-ASLT LRTC-ASLT
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 89.117.152.28:587
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: api.ipify.org
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002ACC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002D3C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002B05000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.00000000029BC000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.00000000029D4000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2243170713.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002E0C000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002C9D000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mail.sintecno.gr
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002941000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2243170713.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000005.00000002.2179507845.0000000004305000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2240669605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cUsRDu.exe, 00000008.00000002.2265925863.0000000004DD4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002941000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000005.00000002.2179507845.0000000004305000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2243170713.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2240669605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cUsRDu.exe, 00000008.00000002.2265925863.0000000004DD4000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002941000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2243170713.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4430975041.0000000002941000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000007.00000002.2243170713.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4432188061.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49721 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, NDL2m67zO.cs .Net Code: Nnak
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, NDL2m67zO.cs .Net Code: Nnak
Installs a global keyboard hook
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Jump to behavior
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4dd42d8.8.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4e0f2f8.7.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.cUsRDu.exe.4340e30.4.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.cUsRDu.exe.4305e10.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.cUsRDu.exe.4340e30.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4e0f2f8.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.cUsRDu.exe.4305e10.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0FF8 0_2_00AB0FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB3310 0_2_00AB3310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB3640 0_2_00AB3640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB3730 0_2_00AB3730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB09F6 0_2_00AB09F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB09C0 0_2_00AB09C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB3920 0_2_00AB3920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0927 0_2_00AB0927
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB3911 0_2_00AB3911
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0A95 0_2_00AB0A95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0ACB 0_2_00AB0ACB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0A55 0_2_00AB0A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0BCA 0_2_00AB0BCA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0B01 0_2_00AB0B01
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB2B68 0_2_00AB2B68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0B5F 0_2_00AB0B5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0C95 0_2_00AB0C95
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0CF1 0_2_00AB0CF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB2C68 0_2_00AB2C68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB2C58 0_2_00AB2C58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0D4D 0_2_00AB0D4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0EA2 0_2_00AB0EA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0E90 0_2_00AB0E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0EEC 0_2_00AB0EEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB0E67 0_2_00AB0E67
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD9CD0 0_2_08BD9CD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD7008 0_2_08BD7008
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD0006 0_2_08BD0006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD0040 0_2_08BD0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD92B7 0_2_08BD92B7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD56E9 0_2_08BD56E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD92C8 0_2_08BD92C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BDAA50 0_2_08BDAA50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD6FF8 0_2_08BD6FF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C46930 0_2_08C46930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C40C80 0_2_08C40C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C43090 0_2_08C43090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C43098 0_2_08C43098
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C410B8 0_2_08C410B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C40848 0_2_08C40848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C40C7C 0_2_08C40C7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C427C0 0_2_08C427C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00EC41F8 4_2_00EC41F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00EC4AC8 4_2_00EC4AC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00ECEB20 4_2_00ECEB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00ECADF0 4_2_00ECADF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00EC3EB0 4_2_00EC3EB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B3440 4_2_066B3440
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B7D40 4_2_066B7D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B65C0 4_2_066B65C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B5580 4_2_066B5580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066BB1F0 4_2_066BB1F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B7660 4_2_066B7660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B5CC8 4_2_066B5CC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066BE348 4_2_066BE348
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B0040 4_2_066B0040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_067AECE8 4_2_067AECE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_067A1DC8 4_2_067A1DC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_067A1DC2 4_2_067A1DC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_066B001B 4_2_066B001B
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_02760FF8 5_2_02760FF8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_02763740 5_2_02763740
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_02760927 5_2_02760927
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_02762C68 5_2_02762C68
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_02762C58 5_2_02762C58
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C7C08 5_2_048C7C08
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C3089 5_2_048C3089
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C0C80 5_2_048C0C80
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C3098 5_2_048C3098
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C10B8 5_2_048C10B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C0848 5_2_048C0848
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_048C27C0 5_2_048C27C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090BE300 5_2_090BE300
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B7008 5_2_090B7008
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B0006 5_2_090B0006
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B0040 5_2_090B0040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B9CD0 5_2_090B9CD0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B6FF8 5_2_090B6FF8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090BAA50 5_2_090BAA50
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B92B7 5_2_090B92B7
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B92C8 5_2_090B92C8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B56E9 5_2_090B56E9
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A741F8 7_2_02A741F8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A74AC8 7_2_02A74AC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A7EA00 7_2_02A7EA00
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A73EB0 7_2_02A73EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A7ACD0 7_2_02A7ACD0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D3440 7_2_067D3440
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D65C0 7_2_067D65C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D5580 7_2_067D5580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067DB1F0 7_2_067DB1F0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D7D40 7_2_067D7D40
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D7660 7_2_067D7660
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067DE348 7_2_067DE348
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D0040 7_2_067D0040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D5CC8 7_2_067D5CC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_067D003F 7_2_067D003F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580FF8 8_2_01580FF8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01583470 8_2_01583470
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01583730 8_2_01583730
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01583640 8_2_01583640
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580927 8_2_01580927
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_015809C0 8_2_015809C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_015809F6 8_2_015809F6
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580B5F 8_2_01580B5F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580B01 8_2_01580B01
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580BCA 8_2_01580BCA
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580A55 8_2_01580A55
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580ACB 8_2_01580ACB
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580A95 8_2_01580A95
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580D4D 8_2_01580D4D
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01582C58 8_2_01582C58
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01582C68 8_2_01582C68
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580CF1 8_2_01580CF1
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580C95 8_2_01580C95
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580E67 8_2_01580E67
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580EEC 8_2_01580EEC
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580E90 8_2_01580E90
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_01580EA2 8_2_01580EA2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C9CD0 8_2_099C9CD0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C7008 8_2_099C7008
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C0006 8_2_099C0006
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C0040 8_2_099C0040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C6FF8 8_2_099C6FF8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C92B7 8_2_099C92B7
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C92C8 8_2_099C92C8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C56E9 8_2_099C56E9
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099CAA50 8_2_099CAA50
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF6860 8_2_09BF6860
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF10B8 8_2_09BF10B8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF3098 8_2_09BF3098
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF3087 8_2_09BF3087
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF0C80 8_2_09BF0C80
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF0848 8_2_09BF0848
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF27C0 8_2_09BF27C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_010541F8 9_2_010541F8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0105E997 9_2_0105E997
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_01054AC8 9_2_01054AC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0105ACD0 9_2_0105ACD0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_01053EB0 9_2_01053EB0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0105DB6F 9_2_0105DB6F
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06943440 9_2_06943440
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06945580 9_2_06945580
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_069465C0 9_2_069465C0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06947D40 9_2_06947D40
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0694B1E0 9_2_0694B1E0
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0694C130 9_2_0694C130
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06947660 9_2_06947660
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06945CB3 9_2_06945CB3
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0694E348 9_2_0694E348
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06940040 9_2_06940040
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06A31DC2 9_2_06A31DC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06A31DC8 9_2_06A31DC8
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06940006 9_2_06940006
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000000.1962549243.0000000000246000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamefUWd.exe" vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d39206-a055-4a9d-b91e-5d355807eddd.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2012548903.0000000002873000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamea9d39206-a055-4a9d-b91e-5d355807eddd.exe4 vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2013488134.0000000003EEE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2011761753.00000000007FE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000000.00000002.2016584360.0000000008F20000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4427699412.0000000000AF9000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Binary or memory string: OriginalFilenamefUWd.exe" vs SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Section loaded: windowscodecs.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4dd42d8.8.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4e0f2f8.7.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.cUsRDu.exe.4340e30.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.cUsRDu.exe.4305e10.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.cUsRDu.exe.4340e30.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4e0f2f8.7.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.cUsRDu.exe.4305e10.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cUsRDu.exe.4.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, OTWUo99bfyR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, OTWUo99bfyR.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, Ui9qhZiA7.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, Ui9qhZiA7.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, BqMB7yHhrXg.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, yk6XYjy0cpoQUTDkYP.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, yk6XYjy0cpoQUTDkYP.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, lhWLDkBCHFxTFQJl1C.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, yk6XYjy0cpoQUTDkYP.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.2589478.5.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.25a8650.3.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8ba0000.12.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 5.2.cUsRDu.exe.2930514.0.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/4@2/2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.log Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Mutant created: \Sessions\1\BaseNamedObjects\QmnjbAzAyFLPnYPGcfCgPKiYXW
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Virustotal: Detection: 50%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.190000.0.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Unpacked PE file: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.190000.0.unpack
.NET source code contains method to dynamically call methods (often used by packers)
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, lhWLDkBCHFxTFQJl1C.cs .Net Code: r8FH6d4Eta System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, lhWLDkBCHFxTFQJl1C.cs .Net Code: r8FH6d4Eta System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, lhWLDkBCHFxTFQJl1C.cs .Net Code: r8FH6d4Eta System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, I1Ds3abkUA5mh3kywv.cs .Net Code: hyVW2X9uL System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_00AB25C5 push ds; retf 0_2_00AB25DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08BD3644 push cs; retf 0_2_08BD3647
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 0_2_08C46288 push esp; retf 0_2_08C46289
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_00EC0B4F push edi; ret 4_2_00EC0CC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Code function: 4_2_067A1658 push cs; retf 4_2_067A165B
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_027625C5 push ds; retf 5_2_027625DD
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 5_2_090B3644 push cs; retf 5_2_090B3647
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A7A298 push esp; ret 7_2_02A7A299
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 7_2_02A70C3D push edi; ret 7_2_02A70CC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_015825C5 push ds; retf 8_2_015825DD
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_099C3644 push cs; retf 8_2_099C3647
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF6528 pushfd ; retf 8_2_09BF6529
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF6490 pushad ; retf 8_2_09BF6491
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 8_2_09BF63F8 push esp; retf 8_2_09BF63F9
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_0105A298 push esp; ret 9_2_0105A299
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_01050B4D push edi; ret 9_2_01050CC2
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Code function: 9_2_06A31658 push cs; retf 9_2_06A3165B
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Static PE information: section name: .text entropy: 7.930941734616937
Source: cUsRDu.exe.4.dr Static PE information: section name: .text entropy: 7.930941734616937
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, v1RhSOaNxZ0gZDmhgB.cs High entropy of concatenated method names: 'Dispose', 'BDx40jps4X', 'Uv9o3mMNLQ', 'CMnYYpu6Vt', 'Fd24VCZINw', 'xo44zN37C2', 'ProcessDialogKey', 'c7AocAISDL', 'aMEo41Hjl3', 'Cfroohq4G8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, aN9FHpOp8kaTf9jmvd.cs High entropy of concatenated method names: 'ljDXCCNrT3', 'pO8XfVdra4', 'aigX6ikOjn', 'l4fXLfa0bG', 'zC7XvNccvd', 'mJ2Xpa4foU', 'VSeXGriNe6', 'Fk7XypuuZx', 'Uk8XDpBEEq', 'bn3XnucA5s'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, lhWLDkBCHFxTFQJl1C.cs High entropy of concatenated method names: 'HpJUNM9knt', 'mplUgqPlWT', 'UcxUaN0COS', 'MqUUiKQkKQ', 'sUOUSBE7Bh', 'WEuUkllKs9', 'NKrUXe7MJs', 'oenUBEMwqk', 'XaxU9nlTU4', 'FwoUrNNIVf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, bSAxTrzu3TCLQ4BHPW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QcCwQqRENK', 'lXHwKeIGGw', 'lWYws4wwTe', 'GU9wABUMIy', 'VgMwWw2WQy', 'Ivxww4dZf0', 'RqPwxQ582h'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, FSZAxKZIeQtACLqTJi.cs High entropy of concatenated method names: 'gpgA5ycnwZ', 'pkTAVvV1GD', 'o39Wc4Xcbc', 'ykbW4g3jv4', 'BvAAtOVP3U', 'YKvAueuxCP', 'eaFAR7rNVW', 'yeZAqY6ago', 'wTCA8guQgR', 'sKlAJTh3nU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, RbZAdWDoG5svxWOtTb.cs High entropy of concatenated method names: 'o3XiL6nrpi', 'jCEipQZutX', 'Pqdiy8HQKD', 'vWViD8r3vC', 'v8UiKlb62g', 'uvCisYFXS1', 'EqbiAanp5Z', 'aUriWw91Q7', 'u8siwmRlsr', 'DCEixMPqIs'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, PfSOI24cDgaIHsVZQjC.cs High entropy of concatenated method names: 'nQHwCEZYob', 'FfuwfSyLGE', 'Xu3w6fBKRE', 'wjDwLX9k5h', 'j6gwvrSpcu', 'osAwpPvirt', 'kOOwGGWRmA', 'yCiwyA7DSb', 'ykswDOegb7', 'o8RwnOtorC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, ebBVZsirCNfoSZtetb.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'UZao0WMs8t', 'e5hoVXKpDZ', 'S5LozNTLYf', 'quGUcVA3oM', 'DEEU4wNssG', 'YdPUoGKIaK', 'SvFUUhuQYe', 'LAbbitFeVrLFyyKL1tT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, WHrM1SordKclNR8Lgt.cs High entropy of concatenated method names: 'FbG6oQSGZ', 'kbhLQVfED', 'Srap8KfQL', 'pnQGjdF9U', 'qUtDBgy67', 'lTZnQA70H', 'nVj4DddmeCTGbwtvlX', 'QPoLPxKTEFmSn6q5nq', 'HWnWfLoQE', 'IKGxqt7KH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, Jq4G8SVxbRw50JQPXM.cs High entropy of concatenated method names: 'foRw43A4CK', 'oU6wULDWDa', 'm1swHvVFU3', 'Hbuwg1ZTif', 'GwrwaohuuP', 'YyTwSLX9SO', 'KUCwkvjiWq', 'hyAWbKKgBe', 'iikW5BE3gA', 'uMvW04nJQe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, YVUAmn2ryKELwQSyN4.cs High entropy of concatenated method names: 'qeZArDUKnu', 'k1pAEXlDrc', 'ToString', 'wD2AgpwJZM', 'CcRAaZSbiW', 'I3PAic3OZ8', 'TLbAS1nveL', 'BKCAk20abk', 'eQeAX7SilG', 'khYABXTkON'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, yk6XYjy0cpoQUTDkYP.cs High entropy of concatenated method names: 'SI8aqX5oIO', 'cBva85toBF', 'yyeaJK98Rq', 'XDBa2bkvwo', 'f4galOBmIb', 'chMaZVnVbg', 'qWDabaVsky', 'cfAa5Nfbij', 'eTha0PlRMv', 'XWeaVloiCy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, kaE8dBnbe23fPkAOxH.cs High entropy of concatenated method names: 'uHBSvEU4WJ', 'y6YSGp29e1', 'TfTimQyhAq', 'vGTienQTG7', 'muDihoLSnV', 'XwjiF3lJ4h', 'Wnuid3m9JH', 'F83i1bMdr5', 'hwMiOjuYxc', 'FHxiPaPycr'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, cwMHT2qdsRulCDIUy3.cs High entropy of concatenated method names: 'wXsKPyOZRf', 'LVoKuiJ9SZ', 'CNeKqNLht4', 'LKoK8PFYiw', 'L88K3MvFLy', 'fLwKm2YQtl', 'eSHKek3yC7', 'yoTKh6RULD', 'tdfKF6ZWtU', 'jroKdtxerI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, ttHfp9RvIOFvtaxFlp.cs High entropy of concatenated method names: 'nVyQyy8mYB', 'gvSQDUiRVV', 'T90QML9ZxZ', 'SXRQ3Fkp4N', 'C6QQeC7wHg', 'sQRQhoWwWZ', 'ishQdRCKem', 'nYxQ1uIobn', 'w0mQPxWw9a', 'yndQtMFlm1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, sYW8hxJjfukAoGBuIV.cs High entropy of concatenated method names: 'ToString', 'bmvstYd3Cw', 'iC4s3U03tr', 'k5hsmLJ9E1', 'glZseUwu92', 'V9UshCFuG3', 'nN6sFsdE4A', 'rFrsdI4H0c', 'c51s1OJcuM', 'h13sOWcdK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, KKimVYMWKGAHd5vvBr.cs High entropy of concatenated method names: 'j8LkN9ove8', 'bALkaocWfX', 'MKakSq4yNR', 'ddgkXhhaES', 'LxrkBj9yXE', 'HgaSln7S4S', 'sN1SZmGsHO', 'jLcSb7tfNQ', 'DkrS5GBEDh', 'JhGS0B4Ysc'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, ElBedKHCaDuGjQq3o1.cs High entropy of concatenated method names: 'qcf4Xk6XYj', 'Xcp4BoQUTD', 'roG4r5svxW', 'NtT4EbBaE8', 'iAO4KxHFKi', 'HVY4sWKGAH', 'DFcnMp7gRd49JYanZO', 'RQnFLY4fowwl9hNQvE', 'vUl44crJS6', 'wYk4UEaO0a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, SLmBlk4ULg9Yfas8S73.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YrYxqOweG2', 'vUnx8WoRxV', 'OvAxJQ4WYS', 'g0Hx2QTUjD', 's9dxllSKAu', 'icaxZMLhFW', 'XfXxb8WxA3'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, qAISDL04ME1Hjl3Gfr.cs High entropy of concatenated method names: 'yXVWM4f1K5', 'oIIW3Okobp', 'IbKWm83u7l', 'kpHWeXcjVH', 'SIdWqLWhgm', 'LvOWhD9KMG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.4174110.7.raw.unpack, K2CZIN5wIo4N37C2U7.cs High entropy of concatenated method names: 'CPHWgWfeZv', 'Hy8Wa9tC2T', 'mR9Wii8KuY', 'a6wWSWdHj8', 'bYoWkIBqbk', 'U4mWX35JBu', 'lXiWBhC3Ob', 'xQAW9DwpDZ', 'vAEWrGKsrE', 'dXBWEwUThw'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, v1RhSOaNxZ0gZDmhgB.cs High entropy of concatenated method names: 'Dispose', 'BDx40jps4X', 'Uv9o3mMNLQ', 'CMnYYpu6Vt', 'Fd24VCZINw', 'xo44zN37C2', 'ProcessDialogKey', 'c7AocAISDL', 'aMEo41Hjl3', 'Cfroohq4G8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, aN9FHpOp8kaTf9jmvd.cs High entropy of concatenated method names: 'ljDXCCNrT3', 'pO8XfVdra4', 'aigX6ikOjn', 'l4fXLfa0bG', 'zC7XvNccvd', 'mJ2Xpa4foU', 'VSeXGriNe6', 'Fk7XypuuZx', 'Uk8XDpBEEq', 'bn3XnucA5s'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, lhWLDkBCHFxTFQJl1C.cs High entropy of concatenated method names: 'HpJUNM9knt', 'mplUgqPlWT', 'UcxUaN0COS', 'MqUUiKQkKQ', 'sUOUSBE7Bh', 'WEuUkllKs9', 'NKrUXe7MJs', 'oenUBEMwqk', 'XaxU9nlTU4', 'FwoUrNNIVf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, bSAxTrzu3TCLQ4BHPW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QcCwQqRENK', 'lXHwKeIGGw', 'lWYws4wwTe', 'GU9wABUMIy', 'VgMwWw2WQy', 'Ivxww4dZf0', 'RqPwxQ582h'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, FSZAxKZIeQtACLqTJi.cs High entropy of concatenated method names: 'gpgA5ycnwZ', 'pkTAVvV1GD', 'o39Wc4Xcbc', 'ykbW4g3jv4', 'BvAAtOVP3U', 'YKvAueuxCP', 'eaFAR7rNVW', 'yeZAqY6ago', 'wTCA8guQgR', 'sKlAJTh3nU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, RbZAdWDoG5svxWOtTb.cs High entropy of concatenated method names: 'o3XiL6nrpi', 'jCEipQZutX', 'Pqdiy8HQKD', 'vWViD8r3vC', 'v8UiKlb62g', 'uvCisYFXS1', 'EqbiAanp5Z', 'aUriWw91Q7', 'u8siwmRlsr', 'DCEixMPqIs'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, PfSOI24cDgaIHsVZQjC.cs High entropy of concatenated method names: 'nQHwCEZYob', 'FfuwfSyLGE', 'Xu3w6fBKRE', 'wjDwLX9k5h', 'j6gwvrSpcu', 'osAwpPvirt', 'kOOwGGWRmA', 'yCiwyA7DSb', 'ykswDOegb7', 'o8RwnOtorC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, ebBVZsirCNfoSZtetb.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'UZao0WMs8t', 'e5hoVXKpDZ', 'S5LozNTLYf', 'quGUcVA3oM', 'DEEU4wNssG', 'YdPUoGKIaK', 'SvFUUhuQYe', 'LAbbitFeVrLFyyKL1tT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, WHrM1SordKclNR8Lgt.cs High entropy of concatenated method names: 'FbG6oQSGZ', 'kbhLQVfED', 'Srap8KfQL', 'pnQGjdF9U', 'qUtDBgy67', 'lTZnQA70H', 'nVj4DddmeCTGbwtvlX', 'QPoLPxKTEFmSn6q5nq', 'HWnWfLoQE', 'IKGxqt7KH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, Jq4G8SVxbRw50JQPXM.cs High entropy of concatenated method names: 'foRw43A4CK', 'oU6wULDWDa', 'm1swHvVFU3', 'Hbuwg1ZTif', 'GwrwaohuuP', 'YyTwSLX9SO', 'KUCwkvjiWq', 'hyAWbKKgBe', 'iikW5BE3gA', 'uMvW04nJQe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, YVUAmn2ryKELwQSyN4.cs High entropy of concatenated method names: 'qeZArDUKnu', 'k1pAEXlDrc', 'ToString', 'wD2AgpwJZM', 'CcRAaZSbiW', 'I3PAic3OZ8', 'TLbAS1nveL', 'BKCAk20abk', 'eQeAX7SilG', 'khYABXTkON'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, yk6XYjy0cpoQUTDkYP.cs High entropy of concatenated method names: 'SI8aqX5oIO', 'cBva85toBF', 'yyeaJK98Rq', 'XDBa2bkvwo', 'f4galOBmIb', 'chMaZVnVbg', 'qWDabaVsky', 'cfAa5Nfbij', 'eTha0PlRMv', 'XWeaVloiCy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, kaE8dBnbe23fPkAOxH.cs High entropy of concatenated method names: 'uHBSvEU4WJ', 'y6YSGp29e1', 'TfTimQyhAq', 'vGTienQTG7', 'muDihoLSnV', 'XwjiF3lJ4h', 'Wnuid3m9JH', 'F83i1bMdr5', 'hwMiOjuYxc', 'FHxiPaPycr'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, cwMHT2qdsRulCDIUy3.cs High entropy of concatenated method names: 'wXsKPyOZRf', 'LVoKuiJ9SZ', 'CNeKqNLht4', 'LKoK8PFYiw', 'L88K3MvFLy', 'fLwKm2YQtl', 'eSHKek3yC7', 'yoTKh6RULD', 'tdfKF6ZWtU', 'jroKdtxerI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, ttHfp9RvIOFvtaxFlp.cs High entropy of concatenated method names: 'nVyQyy8mYB', 'gvSQDUiRVV', 'T90QML9ZxZ', 'SXRQ3Fkp4N', 'C6QQeC7wHg', 'sQRQhoWwWZ', 'ishQdRCKem', 'nYxQ1uIobn', 'w0mQPxWw9a', 'yndQtMFlm1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, sYW8hxJjfukAoGBuIV.cs High entropy of concatenated method names: 'ToString', 'bmvstYd3Cw', 'iC4s3U03tr', 'k5hsmLJ9E1', 'glZseUwu92', 'V9UshCFuG3', 'nN6sFsdE4A', 'rFrsdI4H0c', 'c51s1OJcuM', 'h13sOWcdK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, KKimVYMWKGAHd5vvBr.cs High entropy of concatenated method names: 'j8LkN9ove8', 'bALkaocWfX', 'MKakSq4yNR', 'ddgkXhhaES', 'LxrkBj9yXE', 'HgaSln7S4S', 'sN1SZmGsHO', 'jLcSb7tfNQ', 'DkrS5GBEDh', 'JhGS0B4Ysc'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, ElBedKHCaDuGjQq3o1.cs High entropy of concatenated method names: 'qcf4Xk6XYj', 'Xcp4BoQUTD', 'roG4r5svxW', 'NtT4EbBaE8', 'iAO4KxHFKi', 'HVY4sWKGAH', 'DFcnMp7gRd49JYanZO', 'RQnFLY4fowwl9hNQvE', 'vUl44crJS6', 'wYk4UEaO0a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, SLmBlk4ULg9Yfas8S73.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YrYxqOweG2', 'vUnx8WoRxV', 'OvAxJQ4WYS', 'g0Hx2QTUjD', 's9dxllSKAu', 'icaxZMLhFW', 'XfXxb8WxA3'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, qAISDL04ME1Hjl3Gfr.cs High entropy of concatenated method names: 'yXVWM4f1K5', 'oIIW3Okobp', 'IbKWm83u7l', 'kpHWeXcjVH', 'SIdWqLWhgm', 'LvOWhD9KMG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.40f74f0.9.raw.unpack, K2CZIN5wIo4N37C2U7.cs High entropy of concatenated method names: 'CPHWgWfeZv', 'Hy8Wa9tC2T', 'mR9Wii8KuY', 'a6wWSWdHj8', 'bYoWkIBqbk', 'U4mWX35JBu', 'lXiWBhC3Ob', 'xQAW9DwpDZ', 'vAEWrGKsrE', 'dXBWEwUThw'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, v1RhSOaNxZ0gZDmhgB.cs High entropy of concatenated method names: 'Dispose', 'BDx40jps4X', 'Uv9o3mMNLQ', 'CMnYYpu6Vt', 'Fd24VCZINw', 'xo44zN37C2', 'ProcessDialogKey', 'c7AocAISDL', 'aMEo41Hjl3', 'Cfroohq4G8'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, aN9FHpOp8kaTf9jmvd.cs High entropy of concatenated method names: 'ljDXCCNrT3', 'pO8XfVdra4', 'aigX6ikOjn', 'l4fXLfa0bG', 'zC7XvNccvd', 'mJ2Xpa4foU', 'VSeXGriNe6', 'Fk7XypuuZx', 'Uk8XDpBEEq', 'bn3XnucA5s'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, lhWLDkBCHFxTFQJl1C.cs High entropy of concatenated method names: 'HpJUNM9knt', 'mplUgqPlWT', 'UcxUaN0COS', 'MqUUiKQkKQ', 'sUOUSBE7Bh', 'WEuUkllKs9', 'NKrUXe7MJs', 'oenUBEMwqk', 'XaxU9nlTU4', 'FwoUrNNIVf'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, bSAxTrzu3TCLQ4BHPW.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'QcCwQqRENK', 'lXHwKeIGGw', 'lWYws4wwTe', 'GU9wABUMIy', 'VgMwWw2WQy', 'Ivxww4dZf0', 'RqPwxQ582h'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, FSZAxKZIeQtACLqTJi.cs High entropy of concatenated method names: 'gpgA5ycnwZ', 'pkTAVvV1GD', 'o39Wc4Xcbc', 'ykbW4g3jv4', 'BvAAtOVP3U', 'YKvAueuxCP', 'eaFAR7rNVW', 'yeZAqY6ago', 'wTCA8guQgR', 'sKlAJTh3nU'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, RbZAdWDoG5svxWOtTb.cs High entropy of concatenated method names: 'o3XiL6nrpi', 'jCEipQZutX', 'Pqdiy8HQKD', 'vWViD8r3vC', 'v8UiKlb62g', 'uvCisYFXS1', 'EqbiAanp5Z', 'aUriWw91Q7', 'u8siwmRlsr', 'DCEixMPqIs'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, PfSOI24cDgaIHsVZQjC.cs High entropy of concatenated method names: 'nQHwCEZYob', 'FfuwfSyLGE', 'Xu3w6fBKRE', 'wjDwLX9k5h', 'j6gwvrSpcu', 'osAwpPvirt', 'kOOwGGWRmA', 'yCiwyA7DSb', 'ykswDOegb7', 'o8RwnOtorC'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, ebBVZsirCNfoSZtetb.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'UZao0WMs8t', 'e5hoVXKpDZ', 'S5LozNTLYf', 'quGUcVA3oM', 'DEEU4wNssG', 'YdPUoGKIaK', 'SvFUUhuQYe', 'LAbbitFeVrLFyyKL1tT'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, WHrM1SordKclNR8Lgt.cs High entropy of concatenated method names: 'FbG6oQSGZ', 'kbhLQVfED', 'Srap8KfQL', 'pnQGjdF9U', 'qUtDBgy67', 'lTZnQA70H', 'nVj4DddmeCTGbwtvlX', 'QPoLPxKTEFmSn6q5nq', 'HWnWfLoQE', 'IKGxqt7KH'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, Jq4G8SVxbRw50JQPXM.cs High entropy of concatenated method names: 'foRw43A4CK', 'oU6wULDWDa', 'm1swHvVFU3', 'Hbuwg1ZTif', 'GwrwaohuuP', 'YyTwSLX9SO', 'KUCwkvjiWq', 'hyAWbKKgBe', 'iikW5BE3gA', 'uMvW04nJQe'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, YVUAmn2ryKELwQSyN4.cs High entropy of concatenated method names: 'qeZArDUKnu', 'k1pAEXlDrc', 'ToString', 'wD2AgpwJZM', 'CcRAaZSbiW', 'I3PAic3OZ8', 'TLbAS1nveL', 'BKCAk20abk', 'eQeAX7SilG', 'khYABXTkON'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, yk6XYjy0cpoQUTDkYP.cs High entropy of concatenated method names: 'SI8aqX5oIO', 'cBva85toBF', 'yyeaJK98Rq', 'XDBa2bkvwo', 'f4galOBmIb', 'chMaZVnVbg', 'qWDabaVsky', 'cfAa5Nfbij', 'eTha0PlRMv', 'XWeaVloiCy'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, kaE8dBnbe23fPkAOxH.cs High entropy of concatenated method names: 'uHBSvEU4WJ', 'y6YSGp29e1', 'TfTimQyhAq', 'vGTienQTG7', 'muDihoLSnV', 'XwjiF3lJ4h', 'Wnuid3m9JH', 'F83i1bMdr5', 'hwMiOjuYxc', 'FHxiPaPycr'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, cwMHT2qdsRulCDIUy3.cs High entropy of concatenated method names: 'wXsKPyOZRf', 'LVoKuiJ9SZ', 'CNeKqNLht4', 'LKoK8PFYiw', 'L88K3MvFLy', 'fLwKm2YQtl', 'eSHKek3yC7', 'yoTKh6RULD', 'tdfKF6ZWtU', 'jroKdtxerI'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, ttHfp9RvIOFvtaxFlp.cs High entropy of concatenated method names: 'nVyQyy8mYB', 'gvSQDUiRVV', 'T90QML9ZxZ', 'SXRQ3Fkp4N', 'C6QQeC7wHg', 'sQRQhoWwWZ', 'ishQdRCKem', 'nYxQ1uIobn', 'w0mQPxWw9a', 'yndQtMFlm1'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, sYW8hxJjfukAoGBuIV.cs High entropy of concatenated method names: 'ToString', 'bmvstYd3Cw', 'iC4s3U03tr', 'k5hsmLJ9E1', 'glZseUwu92', 'V9UshCFuG3', 'nN6sFsdE4A', 'rFrsdI4H0c', 'c51s1OJcuM', 'h13sOWcdK2'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, KKimVYMWKGAHd5vvBr.cs High entropy of concatenated method names: 'j8LkN9ove8', 'bALkaocWfX', 'MKakSq4yNR', 'ddgkXhhaES', 'LxrkBj9yXE', 'HgaSln7S4S', 'sN1SZmGsHO', 'jLcSb7tfNQ', 'DkrS5GBEDh', 'JhGS0B4Ysc'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, ElBedKHCaDuGjQq3o1.cs High entropy of concatenated method names: 'qcf4Xk6XYj', 'Xcp4BoQUTD', 'roG4r5svxW', 'NtT4EbBaE8', 'iAO4KxHFKi', 'HVY4sWKGAH', 'DFcnMp7gRd49JYanZO', 'RQnFLY4fowwl9hNQvE', 'vUl44crJS6', 'wYk4UEaO0a'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, SLmBlk4ULg9Yfas8S73.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YrYxqOweG2', 'vUnx8WoRxV', 'OvAxJQ4WYS', 'g0Hx2QTUjD', 's9dxllSKAu', 'icaxZMLhFW', 'XfXxb8WxA3'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, qAISDL04ME1Hjl3Gfr.cs High entropy of concatenated method names: 'yXVWM4f1K5', 'oIIW3Okobp', 'IbKWm83u7l', 'kpHWeXcjVH', 'SIdWqLWhgm', 'LvOWhD9KMG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.8f20000.13.raw.unpack, K2CZIN5wIo4N37C2U7.cs High entropy of concatenated method names: 'CPHWgWfeZv', 'Hy8Wa9tC2T', 'mR9Wii8KuY', 'a6wWSWdHj8', 'bYoWkIBqbk', 'U4mWX35JBu', 'lXiWBhC3Ob', 'xQAW9DwpDZ', 'vAEWrGKsrE', 'dXBWEwUThw'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, R87QTajabri3WprdxA.cs High entropy of concatenated method names: 'SoFXXYTXBr', 'VXePqW7LxoGttIrQMM', 'VJKqh4rSy8UE5CPs2d', 'w7T6rNymrPsVe05ZjX', 'Qa5usbZfG', 'UsaN6r2JI', 'Dispose', 'xdE70OV1R', 'WKG8Nh2TLfQX7DMBJq', 'FCyDZoO16YhsTUYx7V'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, I1Ds3abkUA5mh3kywv.cs High entropy of concatenated method names: 'I6pnpGMEc', 'pUPSoKeTB', 'w3OonGh86', 'S3aaCOvyF', 'MagvcleIh', 'hvmph4XfL', 'eXtqEM8mO', 'RC38AH4Bb', 'hyVW2X9uL', 'AbHynsT40'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, AJO8kvyDr8qxYWB5Qt.cs High entropy of concatenated method names: 'sRJJ4PC1lt6MgSX9oLN', 'qCuPUJCYMdGJYrcKdqj', 'T9OMNMJAsS', 'KH71sVC96gudd8OjhqS', 'qSoaq8CnboJYXbPCm1H', 'XtbiVDCeUWVlZdG2V08', 'D2TFRiCIaLSytg31rTE', 'MtxGm4CM57HGXUKQMIN', 'RgtTUJcyZL', 'eFmMT9Tlnp'
Source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, QEHxtuXFnnkJABhbAo.cs High entropy of concatenated method names: 'Geosg7Hdn', 'wwIBOnTmd', 'siWV4YECO', 'k32FNitut', 'cUAG5mh3k', 'JwvHwu9Dw', 'cr1hyajqeLqaQ4F9dK', 'Pgut89mcfAIn6Hs5oN', 'Dispose', 'MoveNext'
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cUsRDu Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cUsRDu Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File opened: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7916, type: MEMORYSTR
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: A90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 2510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 4510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 4B30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 5B30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 5C60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 6C60000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 9720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: A720000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: ABB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: BBB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: EC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 2940000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: 2860000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2760000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 28A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 48A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4F40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5F40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 6070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 7070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 9590000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4F40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4B90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 1540000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 3090000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2E90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 5780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 6780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 68B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 78B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 9D50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: AD50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: BD50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: C1E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 1040000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 2B10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory allocated: 4B10000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Window / User API: threadDelayed 2119 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Window / User API: threadDelayed 7725 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 3408 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 6450 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 2805 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Window / User API: threadDelayed 7036 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe API coverage: 6.1 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 3580 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -36893488147419080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99516s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99404s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99293s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -99063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98266s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -98047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97938s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97358s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97138s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -97031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96918s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96813s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96688s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -96031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95585s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95265s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -95047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -94937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -94828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -94719s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -94594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe TID: 7376 Thread sleep time: -94484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7512 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -35048813740048126s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7872 Thread sleep count: 3408 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99890s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7872 Thread sleep count: 6450 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99780s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99343s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -99015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98249s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98140s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -98031s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97922s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97812s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97586s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -97047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96718s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96389s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96280s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96164s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -96060s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95951s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95819s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95703s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95575s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95441s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95202s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -95093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -94984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -94875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -94765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -94656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7864 Thread sleep time: -94546s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 7936 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -31359464925306218s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -100000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99438s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99313s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99188s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -99063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98953s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98844s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98609s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98500s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98388s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98281s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98172s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -98063s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97265s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -97047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96566s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96450s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -96234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -95043s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94937s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94828s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94719s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94594s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94484s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94375s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94266s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -94047s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93813s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93688s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93469s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe TID: 8072 Thread sleep time: -93234s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99766 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99641 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99516 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99404 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99293 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99188 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 99063 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98938 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98828 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98719 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98594 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98484 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98375 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98266 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98156 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 98047 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97938 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97813 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97703 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97594 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97469 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97358 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97250 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97138 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 97031 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96918 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96813 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96688 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96578 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96468 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96359 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96250 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96140 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 96031 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95922 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95812 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95703 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95585 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95484 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95375 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95265 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95156 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 95047 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 94937 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 94828 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 94719 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 94594 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Thread delayed: delay time: 94484 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99890 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99780 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99672 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99562 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99453 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99343 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99125 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99015 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98906 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98797 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98687 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98578 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98468 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98359 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98249 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98140 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98031 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97922 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97812 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97703 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97586 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97484 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97375 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97265 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97156 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97047 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96937 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96718 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96389 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96280 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96164 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96060 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95951 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95819 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95703 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95575 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95441 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95312 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95202 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95093 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94984 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94765 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94546 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 100000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99875 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99656 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99547 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99438 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99313 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99188 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 99063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98953 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98844 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98719 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98609 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98388 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98281 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98172 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 98063 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97719 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97594 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97484 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97375 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97265 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97156 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 97047 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96813 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96566 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96450 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 96234 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 95043 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94937 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94828 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94719 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94594 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94484 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94375 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94266 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94156 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 94047 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93938 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93813 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93688 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93578 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93469 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93344 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Thread delayed: delay time: 93234 Jump to behavior
Source: cUsRDu.exe, 00000007.00000002.2241386661.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll_
Source: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe, 00000004.00000002.4427818629.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, cUsRDu.exe, 00000009.00000002.4429878596.0000000001126000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory written: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Memory written: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Process created: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe "C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2243170713.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2240669605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4432188061.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4430975041.00000000029BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4430975041.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2243170713.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2179507845.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4432188061.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2265925863.0000000004DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 7268, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7976, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.30ef7b4.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.28ff8d4.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.30ef7b4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.28ff8d4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2262598265.0000000003099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2015896427.0000000007330000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2012548903.0000000002519000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2178121517.00000000028A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\cUsRDu\cUsRDu.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2240669605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4430975041.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2243170713.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2179507845.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4432188061.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2265925863.0000000004DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 7268, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7976, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.cUsRDu.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4340e30.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.42541d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.428f1f8.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4e0f2f8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.4305e10.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.4dd42d8.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2243170713.0000000002C0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2240669605.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4432188061.0000000002B8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4430975041.00000000029BC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4430975041.0000000002991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2243170713.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2179507845.0000000004305000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.4432188061.0000000002B61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2013488134.0000000004254000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2265925863.0000000004DD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 6468, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe PID: 7268, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7492, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7672, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7916, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: cUsRDu.exe PID: 7976, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.30ef7b4.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.256f9a8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe.7330000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.28ff8d4.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.cUsRDu.exe.30ef7b4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.cUsRDu.exe.28ff8d4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.2262598265.0000000003099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2015896427.0000000007330000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2012548903.0000000002519000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2178121517.00000000028A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1417373 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 29/03/2024 Architecture: WINDOWS Score: 100 29 mail.sintecno.gr 2->29 31 api.ipify.org 2->31 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 8 other signatures 2->53 7 SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe 3 2->7         started        10 cUsRDu.exe 3 2->10         started        12 cUsRDu.exe 2 2->12         started        signatures3 process4 signatures5 55 Detected unpacking (changes PE section rights) 7->55 57 Detected unpacking (overwrites its own PE header) 7->57 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->59 14 SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe 16 5 7->14         started        19 SecuriteInfo.com.Win32.PWSX-gen.9732.1319.exe 7->19         started        61 Antivirus detection for dropped file 10->61 63 Multi AV Scanner detection for dropped file 10->63 65 Machine Learning detection for dropped file 10->65 21 cUsRDu.exe 14 2 10->21         started        67 Injects a PE file into a foreign processes 12->67 23 cUsRDu.exe 2 12->23         started        process6 dnsIp7 33 mail.sintecno.gr 89.117.152.28, 587 LRTC-ASLT Lithuania 14->33 35 api.ipify.org 104.26.12.205, 443, 49707, 49714 CLOUDFLARENETUS United States 14->35 25 C:\Users\user\AppData\Roaming\...\cUsRDu.exe, PE32 14->25 dropped 27 C:\Users\user\...\cUsRDu.exe:Zone.Identifier, ASCII 14->27 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->37 39 Tries to steal Mail credentials (via file / registry access) 14->39 41 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->41 43 Tries to harvest and steal browser information (history, passwords, etc) 23->43 45 Installs a global keyboard hook 23->45 file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.26.12.205
 api.ipify.org United States
13335 CLOUDFLARENETUS false
89.117.152.28
 mail.sintecno.gr Lithuania
15419 LRTC-ASLT true

Contacted Domains

Name IP Active
api.ipify.org 104.26.12.205 true
mail.sintecno.gr 89.117.152.28 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
    		high