Windows Analysis Report
PO874530040021 YIKANG INQUIRY.com.exe

Overview

General Information

Sample name:	PO874530040021 YIKANG INQUIRY.com.exe
Analysis ID:	1445948
MD5:	86a0fbc943d577f93faf00394997bb22
SHA1:	bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA256:	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
Tags:	comexe
Infos:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Opens the same file many times (likely Sandbox evasion)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO874530040021 YIKANG INQUIRY.com.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: PO874530040021 YIKANG INQUIRY.com.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 73.4% probability

Uses 32bit PE files

Source: PO874530040021 YIKANG INQUIRY.com.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: PO874530040021 YIKANG INQUIRY.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,	0_2_0040646B
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004058BF

Source: PO874530040021 YIKANG INQUIRY.com.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: PO874530040021 YIKANG INQUIRY.com.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_0040535C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040535C

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Process Stats: CPU usage > 49%

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_00403348 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403348

Creates files inside the system directory

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Windows\stepsire	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Windows\stepsire\Diamondbacks22	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Windows\resources\0809	Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_00406945	0_2_00406945
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_0040711C	0_2_0040711C
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_6ED81A98	0_2_6ED81A98

Sample file is different than original file name gathered from version info

Source: PO874530040021 YIKANG INQUIRY.com.exe, 00000000.00000000.1192273033.0000000000455000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesolaarene frankeniaceae.exe4 vs PO874530040021 YIKANG INQUIRY.com.exe
Source: PO874530040021 YIKANG INQUIRY.com.exe	Binary or memory string: OriginalFilenamesolaarene frankeniaceae.exe4 vs PO874530040021 YIKANG INQUIRY.com.exe

Uses 32bit PE files

Source: PO874530040021 YIKANG INQUIRY.com.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/20@0/0

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

0_2_00403348

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_0040460D GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040460D

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_0040216B CoCreateInstance,MultiByteToWideChar,

0_2_0040216B

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

File created: C:\Users\user\AppData\Local\skolebetjents

Jump to behavior

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsjD839.tmp

Jump to behavior

Source: PO874530040021 YIKANG INQUIRY.com.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO874530040021 YIKANG INQUIRY.com.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

File read: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Jump to behavior

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: polres.lnk.0.dr

LNK file: ..\..\user~1\AppData\Local\Temp\nseD905.tmp\Revitalizers\Forsoldet.Cho46

Source: PO874530040021 YIKANG INQUIRY.com.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.3711323210.0000000006BFD000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_6ED81A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6ED81A98

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_6ED82F60 push eax; ret

0_2_6ED82F8E

Drops PE files

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Users\user\AppData\Local\Temp\nseD905.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Users\user\AppData\Local\Temp\nseD905.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	File created: C:\Users\user\AppData\Local\Temp\nseD905.tmp\UserInfo.dll	Jump to dropped file

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Opens the same file many times (likely Sandbox evasion)

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\redargue\demonising.ini count: 408630

Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

RDTSC instruction interceptor: First address: 6F01608 second address: 6F01608 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 mov edx, 0000006Ch 0x00000008 cmp edx, 1DAEFCFFh 0x0000000e jg 00007FDD0909CAFAh 0x00000014 pop edx 0x00000015 test ebx, 64F9669Ch 0x0000001b cmp ebx, ecx 0x0000001d jc 00007FDD09079DCFh 0x0000001f inc ebp 0x00000020 inc ebx 0x00000021 test bl, dl 0x00000023 rdtsc

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseD905.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseD905.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseD905.tmp\UserInfo.dll	Jump to dropped file

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_0040646B FindFirstFileA,FindClose,	0_2_0040646B
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_004027A1 FindFirstFileA,	0_2_004027A1
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	Code function: 0_2_004058BF GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004058BF

Source: PO874530040021 YIKANG INQUIRY.com.exe, 00000000.00000002.3646798597.0000000000748000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe	API call chain: ExitProcess graph end node

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

Code function: 0_2_6ED81A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_6ED81A98

Source: C:\Users\user\Desktop\PO874530040021 YIKANG INQUIRY.com.exe

0_2_00403348

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1445948
Product:	CloudBasic
Start time:	20:14:49
Start date:	22.05.2024
Sample:	PO874530040021 YIKANG INQUIRY.com.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	86a0fbc943d577f93faf00394997bb22
SHA1:	bc1bd20d88ce7f659dbab2752d670f8cce3ff8e3
SHA256:	b4834413f9bedbc2d64ba07d1401e4d1eb44a54adbca90bb79fc67bf03fa4ab5
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\Public\Desktop\polres.lnk	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide	BE8BA03DD2EF5F9592C90FAFA8614701	005C4D35ADD2ED89545C717AEF3F72FFF8D19AA3	E729B87D00DE0F977376EC454C25E066558C1869C451C2B4B731009BB068DFF8
C:\Users\user\AppData\Local\Temp\nseD905.tmp\System.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	4CA4FD3FBEFA2F6E87E6E9EE87D1C0B3	7CDBEB5FF2B14B86AF04E075D0CA651183EA5DF4	D09A8B3ADE4BA4B7292C0B3DA1BCB4B6C6E2012E0CCFD5E029A54AF73A9E1B57
C:\Users\user\AppData\Local\Temp\nseD905.tmp\UserInfo.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	035BDB470A6807313BD005BD98341FFC	5017D1E5A23F1C64594F737E6FCCD519729C3B3E	26FA900E3426B4DD272707E1AAF428B5EE06BDC2CC2BBAECDAB6B54F11F38F27
C:\Users\user\AppData\Local\Temp\nseD905.tmp\nsDialogs.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	EB2C74E05B30B29887B3219F4EA3FDAB	91173D46B34E7BAE57ACABDBD239111B5BCC4D9E	D253CA5ABA34B925796777893F114CC741B015AF7868022AB1DB2341288C55ED
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\Laparocolpohysterotomy162.fra	data	623272435DE8395E801ABF39701074A3	5E234E9270EFAB606464277FABE18436FD92E6BD	FE85D7B25A41EE93F1A172F4F8F0489A83C24D03A0AC59066E79A1F58F9C5382
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\Lrketr160.bel	data	556C42AD236F523422A8D33C7E01D769	86AD2EE8FAD51E33C3D316083FE427E7D59F8BA2	47C9FA08E1FDB45FF4B68936E127BEF728DF2558B79CEA6F9CF812E7A06580E5
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\Misdefine.vil	data	BC7EDBFCEF64A6C616650E2D9A5A7245	A87D7BD6A4174FA5BF293BE370C4C08B319A144B	02A443F69D7695AFB9B48BFA4F79D2820C1F5C0ED7747EFFDC5CDC7E5DA04747
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\Taino.Tan3	data	0214EE3B483B2BD30009DBC109B33F4D	79FDEF32D664A5ED7E377D8A8127BD91F4455D8F	78B1099C045A7E1F8D3FC37177AC87EBC93AD1FFE082A705A1DAEB27BE55FF74
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\Tgernes.sub	data	D6ECEC90DDD9777C15163FE9F5346807	1FFDDBB693F9F12ECFF3E68B8806A257FEDD9DDE	DAF8AC46EE15628FE4834408DE7FEB876F87E5625A205B85CB230B11CD41A3DE
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\sphagnaceae\Stuepigen.hor	data	6968CFE66311AE9BB0DED77DE8492562	B2991E4B0427E879AD2ABDA54D94624B2D0EAC1E	D15FD3D370057160C77A483D9659CF6E79B3892665E0D87D9EF8859E4BE1AE59
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\sphagnaceae\Talbehandlings88.uve	data	AAEFD238CA955B45BC68D442FB059D5B	71FA1CA71CD483235E0121CB39C34F81511F975B	241C8E953F55CE7B68983303E62DD43663DCAD2D32482318A0C9E13A59E37FFF
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\sphagnaceae\Thunderhead118.dop	data	6C88A30B4D494FECB6B1364F0E591B9B	962C04C3D1A5DF4AA609AF206C3C351E25C8ED52	6CE8E19EAF50DF4811F04535695C2146C0D9664E70428E27DA844D99FE8DCA7E
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\sphagnaceae\advancing.fol	data	7FEA240209F8B573DEFE77AF303502E9	FB010E47DAB492098E2B596AFCDAE259AAB5491F	477003DCDB6BFBC409E90BB3E12BF4DE2437FC37E3944609B6D1563E0B4119F0
C:\Users\user\AppData\Local\skolebetjents\Improvisatorens\sphagnaceae\bepepper.txt	ASCII text, with CRLF line terminators	AE6051F666A4BE61FEE72E82BE9472FF	75E78487542EB4829CBEC88DEA748B7F83D6D93E	2967EBEB5E16E9FB16CEB5F2770CC1718C9085D5188DEC59F45A9B97640B926A
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\bjrneskindenes.gal	data	2F948404EA3C59278E0D9BFCBE8D4C40	5378D5D2B0FC0D0B8B966B5D902EB1BC7E6D779D	28958123B65F320945BF723D1C61D73C3A8EB8312564074CB35E322FACB0DBEC
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\modalities.ali	data	A8C0B0FD25B502DC728C818B01C4705E	83C8F134624D964B0946E634229C09262B786358	03822E3B8D5042BBC7751BABF9A2510E4C41F75AABAEF9D7317DAFED5C2DA04D
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\parkere.lov	data	9ADD6AD16F4E7B71089D9807757A8B85	0127249EDC98852B4AFC12B17D8C00EA4BDE8519	82B86D8FB42303AE132DC37792151FDE087070B9AE5DD01BBC2D77B5762942F5
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\retouchr.app	data	78C3F9CAADC9005059318C41AF371F53	47427BE3D4D5C20B10EBE761D44FC3C6DD82B92F	38DA1491F6996D1BD6C41949BB0EE04431D1F26991849BE89B3A4FAE488B76B1
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\serendipitously.int	data	66FE8032945556E76D24C01F08AA618B	2D1C5646DD4DE7BE749CA66729962DBDAB1AD4D6	8A0A214E24B244B5482BA9B064199EA53BC3975C89F70C04E8CF3021EA49FE56
C:\Users\user\AppData\Local\skolebetjents\Spadestrens\skonnertbrig.pan	data	2A94C01E0FEC66A108816A0758176AAD	E13323600B9250DE1EB773D897D4278F57ADC5C4	B2B861402ECF76335D00DF2551817EF8D8B1307D8D3E0A1349149779B26EB40A

Windows Analysis Report
PO874530040021 YIKANG INQUIRY.com.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report PO874530040021 YIKANG INQUIRY.com.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
PO874530040021 YIKANG INQUIRY.com.exe

Malware Threat Intel
Provided by