Windows Analysis Report
Plat#U0103 revizuit#U0103_shrunk.exe

Overview

General Information

Sample name: Plat#U0103 revizuit#U0103_shrunk.exe
renamed because original name is a hash value
Original sample name: Plat revizuit_shrunk.exe
Analysis ID: 1518504
MD5: 8eca59816dc6007ae4a40dc09ac5b66f
SHA1: 7ab4088c162ad70f5456dacd1fe34150e22f9e0d
SHA256: d4f4ad6ea2e448166edde53a24011ddc5c4e870f7c571f9dd5e390e582ca3d33
Tags: exeuser-malrpt
Infos:

Detection

AgentTesla, Neshta
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Neshta
Yara detected Telegram RAT
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Creates an undocumented autostart registry key
Drops PE files with a suspicious file extension
Drops executable to a common third party application directory
Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to query locales information (e.g. system language)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Classes Autorun Keys Modification
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Name Description Attribution Blogpost URLs Link
neshta Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something." No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

AV Detection
barindex
Found malware configuration
Source: powershell.exe.6568.5.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage?chat_id=-4166410344"}
Source: Plat#U0103 revizuit#U0103_shrunk.exe.3380.0.memstrmin Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage"}
Multi AV Scanner detection for submitted file
Source: Plat#U0103 revizuit#U0103_shrunk.exe ReversingLabs: Detection: 28%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Plat#U0103 revizuit#U0103_shrunk.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.10.dr
Source: Binary string: NisSrv.pdb source: NisSrv.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.10.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WmQc.pdbs\WmQc.pdbpdbmQc.pdbg\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: HP^o(C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.10.dr
Source: Binary string: \??\C:\Windows\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdbOGP source: setup.exe.10.dr
Source: Binary string: C:\Windows\WmQc.pdbpdbmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !!.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: WmQc.pdb^1w^ source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdb source: NAMECONTROLSERVER.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.10.dr
Source: Binary string: WmQc.pdb21-2246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32EW source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdbE source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @jo.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb} source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ker.pdb source: OfficeScrBroker.exe.10.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbZ source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.10.dr
Source: Binary string: WmQc.pdbSHA256 source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source: Binary string: symbols\exe\WmQc.pdbjo source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.10.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.10.dr
Source: Binary string: ?joC:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\WmQc.pdbe source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdbker.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OfficeScrBroker.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb source: ORGCHART.EXE.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdb source: setup.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ORGCHART.EXE.10.dr
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbP source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.10.dr
Source: Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source: Binary string: \??\C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.10.dr
Source: Binary string: MpCmdRun.pdb source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb.1D source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdb source: PerfBoost.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.10.dr
Source: Binary string: \??\C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SCANPST.EXE.10.dr
Source: Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source: Binary string: T.pdb source: SELFCERT.EXE.10.dr
Source: Binary string: in32.pdb source: officeappguardwin32.exe.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source: Binary string: WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source: Binary string: \??\C:\Windows\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\WmQc.pdbj source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdb source: OfficeScrBroker.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: NisSrv.pdbGCTL source: NisSrv.exe0.10.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdb source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source: Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: PerfBoost.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: NAMECONTROLSERVER.EXE.10.dr
Source: Binary string: \??\C:\Windows\symbols\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb source: SCANPST.EXE.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.10.dr
Source: Binary string: \??\C:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp

Spreading
barindex
Yara detected Neshta
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Users\user\AppData\Local\Temp\chrome.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00405080 FindFirstFileA,FindNextFileA,FindClose, 10_2_00405080
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00405634 FindFirstFileA,FindNextFileA,FindClose, 10_2_00405634
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404F6C FindFirstFileA,FindClose, 10_2_00404F6C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004056A7 FindFirstFileA,FindNextFileA,FindClose, 10_2_004056A7
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA, 10_2_00406D40
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\ Jump to behavior

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: SELFCERT.EXE.10.dr String found in binary or memory: http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC
Source: jp2launcher.exe.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: jp2launcher.exe.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NisSrv.exe0.10.dr String found in binary or memory: http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00https://F
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: jp2launcher.exe.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: jp2launcher.exe.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 0000000A.00000002.2664741761.0000000001130000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: jp2launcher.exe.10.dr String found in binary or memory: http://ocsp.digicert.com0
Source: jp2launcher.exe.10.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: jp2launcher.exe.10.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: jp2launcher.exe.10.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2322866054.0000000003127000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/
Source: SPREADSHEETCOMPARE.EXE.10.dr String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUser
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUserResponse
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUser
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUserResponse
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfig
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfigResponse
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettings
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettings
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse
Source: officeappguardwin32.exe.10.dr String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R
Source: Aut2exe.exe.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: AutoIt3_x64.exe.10.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: jp2launcher.exe.10.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: OcPubMgr.exe.10.dr String found in binary or memory: http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/
Source: pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: NisSrv.exe0.10.dr String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: NisSrv.exe0.10.dr String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: NisSrv.exe0.10.dr String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr String found in binary or memory: https://www.globalsign.com/repository/0
Installs a raw input device (often for capturing keystrokes)
Source: FLTLDR.EXE.10.dr Binary or memory string: RegisterRawInputDevices memstr_c04288df-1

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Neshta Author: ditekSHen
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.40a698.1.unpack, type: UNPACKEDPE Matched rule: Detects Neshta Author: ditekSHen
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Neshta Author: ditekSHen
Creates files inside the system directory
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Windows\svchost.com Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_012CDEEC 0_2_012CDEEC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07164510 0_2_07164510
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07166580 0_2_07166580
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07166148 0_2_07166148
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_0716D148 0_2_0716D148
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07166E58 0_2_07166E58
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07166E48 0_2_07166E48
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_07164948 0_2_07164948
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_02ECDEEC 11_2_02ECDEEC
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_054D0040 11_2_054D0040
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_054D0006 11_2_054D0006
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C6E58 11_2_071C6E58
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C6E48 11_2_071C6E48
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C4510 11_2_071C4510
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C6580 11_2_071C6580
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C4948 11_2_071C4948
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C6148 11_2_071C6148
One or more processes crash
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748
PE file does not import any functions
Source: msedgewebview2.exe.10.dr Static PE information: No import functions for PE file found
Source: msedge_proxy.exe.10.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename1dc79151-ab82-45c7-a1ea-3f75fbff36ed.exe4 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2201009082.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2221290682.0000000007E50000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename1dc79151-ab82-45c7-a1ea-3f75fbff36ed.exe4 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2216989105.0000000006F7F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename;' vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe Binary or memory string: OriginalFilenameWmQc.exe> vs Plat#U0103 revizuit#U0103_shrunk.exe
Uses 32bit PE files
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.40a698.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iKHPXKiqI.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: _0020.SetAccessControl
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: _0020.AddAccessRule
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, EWBDlTwtvjH60TEEpY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: _0020.SetAccessControl
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs Security API names: _0020.AddAccessRule
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, EWBDlTwtvjH60TEEpY.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: OfficeScrBroker.exe.10.dr Binary string: NtCreateFilentdll.dll\Device\Afd\WepollNtWaitForKeyedEventNtCreateKeyedEventRtlNtStatusToDosErrorNtDeviceIoControlFileNtReleaseKeyedEventtcpwsipcudp%s (%s:%d)
Source: MpCmdRun.exe2.10.dr Binary string: IdImageFileNameFirst Resource TypeTypeScan SourceFirst Resource PathuserIdResource CountReasonProcessMessagePIDStartStopDataIsSignedFile\Device\\\?\\FI_UNKNOWN\drivers\error: invalid data: System Windows path changed during the trace from "%ls" to "%ls"
Source: classification engine Classification label: mal100.spre.troj.evad.winEXE@19/195@0/0
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3816:120:WilError_03
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4560:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3748
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp Jump to behavior
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Plat#U0103 revizuit#U0103_shrunk.exe ReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File read: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe C:\Users\user\AppData\Roaming\iKHPXKiqI.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: ntvdm64.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static file information: File size 1592832 > 1048576
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.10.dr
Source: Binary string: NisSrv.pdb source: NisSrv.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.10.dr
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WmQc.pdbs\WmQc.pdbpdbmQc.pdbg\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: HP^o(C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.10.dr
Source: Binary string: \??\C:\Windows\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdbOGP source: setup.exe.10.dr
Source: Binary string: C:\Windows\WmQc.pdbpdbmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: !!.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: WmQc.pdb^1w^ source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdb source: NAMECONTROLSERVER.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.10.dr
Source: Binary string: WmQc.pdb21-2246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32EW source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\System.pdbE source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @jo.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb} source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ker.pdb source: OfficeScrBroker.exe.10.dr
Source: Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbZ source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.10.dr
Source: Binary string: WmQc.pdbSHA256 source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source: Binary string: symbols\exe\WmQc.pdbjo source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.10.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source: Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.10.dr
Source: Binary string: ?joC:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\exe\WmQc.pdbe source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdbker.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OfficeScrBroker.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb source: ORGCHART.EXE.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdb source: setup.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ORGCHART.EXE.10.dr
Source: Binary string: \??\C:\Windows\symbols\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdbP source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.10.dr
Source: Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source: Binary string: \??\C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.10.dr
Source: Binary string: MpCmdRun.pdb source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source: Binary string: C:\Windows\System.pdbpdbtem.pdb.1D source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdb source: PerfBoost.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.10.dr
Source: Binary string: \??\C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SCANPST.EXE.10.dr
Source: Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source: Binary string: T.pdb source: SELFCERT.EXE.10.dr
Source: Binary string: in32.pdb source: officeappguardwin32.exe.10.dr
Source: Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source: Binary string: WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source: Binary string: \??\C:\Windows\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\exe\WmQc.pdbj source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdb source: OfficeScrBroker.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.10.dr
Source: Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source: Binary string: NisSrv.pdbGCTL source: NisSrv.exe0.10.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: MsMpEng.pdb source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source: Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: PerfBoost.exe.10.dr
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: NAMECONTROLSERVER.EXE.10.dr
Source: Binary string: \??\C:\Windows\symbols\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb source: SCANPST.EXE.10.dr
Source: Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.10.dr
Source: Binary string: \??\C:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Plat#U0103 revizuit#U0103_shrunk.exe, MainForm.cs .Net Code: InitializeComponent
Source: iKHPXKiqI.exe.0.dr, MainForm.cs .Net Code: InitializeComponent
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs .Net Code: A4fr1GoWJPe2RT1Dwen System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs .Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs .Net Code: A4fr1GoWJPe2RT1Dwen System.Reflection.Assembly.Load(byte[])
Source: msedge_proxy.exe.10.dr, MainForm.cs .Net Code: InitializeComponent
Binary contains a suspicious time stamp
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: 0xC91F9674 [Fri Dec 4 06:55:48 2076 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_012CE02D push ebp; retn 0002h 0_2_012CE032
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_012CAFCA push esi; iretd 0_2_012CAFCB
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 0_2_0716419D push B9FFFFFFh; ret 0_2_071641A2
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_0040802C push 00408052h; ret 10_2_0040804A
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004070A4 push 004070D0h; ret 10_2_004070C8
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004041D8 push 00404204h; ret 10_2_004041FC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004041A0 push 004041CCh; ret 10_2_004041C4
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404256 push 00404284h; ret 10_2_0040427C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404258 push 00404284h; ret 10_2_0040427C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404210 push 0040423Ch; ret 10_2_00404234
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004042C8 push 004042F4h; ret 10_2_004042EC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404290 push 004042BCh; ret 10_2_004042B4
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404370 push 0040439Ch; ret 10_2_00404394
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404300 push 0040432Ch; ret 10_2_00404324
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404338 push 00404364h; ret 10_2_0040435C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004043E0 push 0040440Ch; ret 10_2_00404404
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004043A8 push 004043D4h; ret 10_2_004043CC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00406CE0 push 00406D36h; ret 10_2_00406D2E
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_0040DCAC push ss; iretd 10_2_0040DD4C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00403D28 push 00403D79h; ret 10_2_00403D71
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_0040DE43 push cs; iretd 10_2_0040DE4E
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_0040DEF1 push cs; iretd 10_2_0040DF14
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00403F58 push 00403F84h; ret 10_2_00403F7C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_0040DF15 push ss; iretd 10_2_0040DF4A
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00403F90 push 00403FBCh; ret 10_2_00403FB4
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_054DEB08 pushfd ; iretd 11_2_054DEB09
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Code function: 11_2_071C419D push B9FFFFFFh; ret 11_2_071C41A2
Source: Plat#U0103 revizuit#U0103_shrunk.exe Static PE information: section name: .text entropy: 7.864633377561674
Source: iKHPXKiqI.exe.0.dr Static PE information: section name: .text entropy: 7.864633377561674
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, i3QFsjjoAPkUndGBmc.cs High entropy of concatenated method names: 'nxBhvINf01', 'JM5hJVYI0G', 'xkyh5PXUgn', 'DFJhC5ZybL', 'RebhsmNwGI', 'iF3hNIpSUS', 'vmkhGGiMUL', 'AWnLaUPho5', 'QsULMQN5ay', 'hhDLjgUMCR'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, lympCmhAo8DkBB5YJn.cs High entropy of concatenated method names: 'bCrOkBj3yF', 'lQUO06s2Un', 'RpHOy05m9w', 'JyKOcc9mZl', 'GXXOKH4pcU', 'R6FOeL3XCN', 'qBKOtvRvS6', 'Ge9OH13XRJ', 'CGsOYrVOF5', 'sJxODRq5NA'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Ev4NU9fl0WsJ9RcSij.cs High entropy of concatenated method names: 'TsKEUapl2Y', 'jVwESIyy1n', 'ToString', 'M0MECN8NWQ', 'q1ZEsCsu0i', 'J09E48r9q1', 'WYKENl8E8n', 'paVEGsDPgw', 'gBZEFn2Jgh', 'aMDEVMp6JD'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, EWBDlTwtvjH60TEEpY.cs High entropy of concatenated method names: 'V9hs202UtI', 'sIAs6dkNkR', 'lyTs1aJDbd', 'b5IsosevID', 'HYYsdq58oj', 'T1WsT9MWZ3', 'tpUsa0w3Q4', 'YHisMRBWwf', 'gAYsj4tOJP', 't0Rsn7M02o'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, dHK0JAuufJel4uCYfC.cs High entropy of concatenated method names: 'leM4PP1phQ', 'AeU49aHpqw', 'DId4kS12me', 'yNb40SQfX7', 'fag48WwoFd', 'qM74pIsRni', 'Hm24E47CPI', 'loJ4Lm9YO0', 'rGL4hSDSqC', 'xeI43pJhBf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, lbaPktE2bTWtbRkDt5.cs High entropy of concatenated method names: 'fO0FCfV5kk', 'n8VF4mcPfI', 'jvJFGMXW5B', 'jUqGnuhGS0', 'sxxGzlKef0', 'NytFuOeJJg', 'l5dFvxweGj', 'fLfFbECSmX', 'wytFJbRSIg', 'FXvF5UFpKL'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, qodqsKeqLvo5DFFps0.cs High entropy of concatenated method names: 'R7BNi9Opoc', 'rx8NXlbyXH', 'EOU4Q10dXb', 'Sut4KeJ4DH', 'NVO4etyoNx', 'PA047gnhPe', 'yCA4tPmLFn', 'NVp4HpoKyC', 'Ebw4Z1ebnZ', 'sCs4YrwrqI'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nIZjT41dYUX23CleyT.cs High entropy of concatenated method names: 'SnXFlWS2UG', 'AyaFBAWhW8', 'BypFrojx4u', 'uIHFP6sISb', 'C3bFixMA9I', 'yFNF9E6hFn', 'UFkFXiPDbr', 'eFDFkZU7mU', 'lEZF0KuY5m', 'BUKFqU1nPG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, HDAe46A2O6fF0GX7vE.cs High entropy of concatenated method names: 'CbFLC7kTI7', 'CfPLs2xjxu', 'wIeL4SnWyK', 'e2yLNv8ENY', 'TdMLGGH3iD', 'SG7LFTibTy', 'CybLVcKHjY', 'vxGLm8du6p', 'PuGLUGNTKM', 'aJgLS3G1L9'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, l33W9b55KZlmGgZZfOs.cs High entropy of concatenated method names: 'ToString', 'gNp3JLDgqY', 'NBd35L6JMk', 'dKm3R52w7F', 'McF3CCqiHI', 'vuW3s9hcrZ', 'gXt34o9f0C', 'dQx3NfuSva', 'Lat0GLFrDZVByffRPNb', 'VNAPKiFtZypWVKxQwZm'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, uhS9RZ5ahWF0HqJupPq.cs High entropy of concatenated method names: 'bT3hllU7bm', 'riFhBPMJj4', 'BWkhrcPq6D', 'gWxhP1CnkK', 'bRNhiDwCFY', 'tCYh9GJi6I', 'pMRhXQs52t', 'wR0hkdx87w', 'uhoh0ElEX5', 'hAahqumiXV'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, mnZWJCLmR68gF25k1b.cs High entropy of concatenated method names: 'ektEMLI7i1', 'NPOEnYTQ6u', 'IogLuOZpJG', 'oP6LvwT5cX', 'DItEDmUFmj', 'y4qEgkEiGO', 'PCpExVbt4e', 'O25E2rZJ8U', 'hfpE6frD0Z', 'bNcE19aM3V'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nNpPf2bbiU0wr5aAbG.cs High entropy of concatenated method names: 'tJRGRppK14', 'KQ6Gscq9nC', 'Aw9GNvOMqU', 'tdxGFBqoCC', 'sf2GVJNRk1', 'slfNd9Y4M5', 'BKTNTEIoXV', 'raCNaItRTA', 'qPuNMpb1li', 'uoFNj2jhRw'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs High entropy of concatenated method names: 'pZeJRwNh2J', 'BlsJCUKBu2', 'mtDJsoE9gD', 'ybTJ4584LE', 'SUXJNKU7EM', 'vDFJGXmog0', 'ge8JFWUm4L', 'cysJVjHT6L', 'vuKJmO8QX7', 'yxoJU4C5Mf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, sMffnmzUkmObinjZBa.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DuqhO678ql', 'svQh8yDKvO', 'uiIhph5941', 'urhhEKAGJX', 'FskhLhjcvS', 'vhXhhTkTrL', 'IdDh341Q5i'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, j1GIrwPHgpSbc4PlfT.cs High entropy of concatenated method names: 'NXCLy4vJ15', 'DFjLcRAklq', 'JhYLQOFx6s', 'j4pLKWHI7c', 'JP1L29CoYY', 'ivwLe24UBS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, jwCfPD5VUsRfBbdgXYY.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LMU32Gy81E', 'VJy36eEJRV', 'fgM31Pfw61', 'b2Z3ooitw5', 'rdi3dMVCrd', 'DOZ3ToEYNX', 'U1f3ap0T89'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, dakg5lc8YcgJC3pGDS.cs High entropy of concatenated method names: 'lePvFRIqSx', 'c9hvV9VkPp', 'iBcvUhBxTs', 'mxCvSbavG5', 'IH3v8OBY0Q', 'KVYvpUnBfd', 'WE6VVmIR9HqicFOc58', 'rOxHNId5OOW8VoUcUp', 'iTovvgOlHw', 'La7vJ753jb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, wBrAhgpZKKs8gFMTeX.cs High entropy of concatenated method names: 'rhurNtPmf', 'Bw0PyZ1Mv', 's6g9tv3f0', 'X5UXnJ8aR', 'vtV0N97Io', 'IUjqK3unb', 'RRP6f4XvZxghQE4Zun', 'zxSjGJqkJljY7ZFRtM', 'Vv9Ly93yF', 'tvl3jahZF'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nv7pDIdaGY08lNoLhp.cs High entropy of concatenated method names: 'Dispose', 'ptOvjw0vRq', 'AjebcTD0Y4', 'fhvIIrHU6h', 'iFQvnM6hpK', 'fkUvzK4eqi', 'ProcessDialogKey', 's9gbucpt7e', 'AShbvSd6kj', 'UOhbb4MUYb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, kD0JNdgNBriBGn5egS.cs High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, i3QFsjjoAPkUndGBmc.cs High entropy of concatenated method names: 'nxBhvINf01', 'JM5hJVYI0G', 'xkyh5PXUgn', 'DFJhC5ZybL', 'RebhsmNwGI', 'iF3hNIpSUS', 'vmkhGGiMUL', 'AWnLaUPho5', 'QsULMQN5ay', 'hhDLjgUMCR'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, lympCmhAo8DkBB5YJn.cs High entropy of concatenated method names: 'bCrOkBj3yF', 'lQUO06s2Un', 'RpHOy05m9w', 'JyKOcc9mZl', 'GXXOKH4pcU', 'R6FOeL3XCN', 'qBKOtvRvS6', 'Ge9OH13XRJ', 'CGsOYrVOF5', 'sJxODRq5NA'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Ev4NU9fl0WsJ9RcSij.cs High entropy of concatenated method names: 'TsKEUapl2Y', 'jVwESIyy1n', 'ToString', 'M0MECN8NWQ', 'q1ZEsCsu0i', 'J09E48r9q1', 'WYKENl8E8n', 'paVEGsDPgw', 'gBZEFn2Jgh', 'aMDEVMp6JD'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, EWBDlTwtvjH60TEEpY.cs High entropy of concatenated method names: 'V9hs202UtI', 'sIAs6dkNkR', 'lyTs1aJDbd', 'b5IsosevID', 'HYYsdq58oj', 'T1WsT9MWZ3', 'tpUsa0w3Q4', 'YHisMRBWwf', 'gAYsj4tOJP', 't0Rsn7M02o'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, dHK0JAuufJel4uCYfC.cs High entropy of concatenated method names: 'leM4PP1phQ', 'AeU49aHpqw', 'DId4kS12me', 'yNb40SQfX7', 'fag48WwoFd', 'qM74pIsRni', 'Hm24E47CPI', 'loJ4Lm9YO0', 'rGL4hSDSqC', 'xeI43pJhBf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, lbaPktE2bTWtbRkDt5.cs High entropy of concatenated method names: 'fO0FCfV5kk', 'n8VF4mcPfI', 'jvJFGMXW5B', 'jUqGnuhGS0', 'sxxGzlKef0', 'NytFuOeJJg', 'l5dFvxweGj', 'fLfFbECSmX', 'wytFJbRSIg', 'FXvF5UFpKL'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, qodqsKeqLvo5DFFps0.cs High entropy of concatenated method names: 'R7BNi9Opoc', 'rx8NXlbyXH', 'EOU4Q10dXb', 'Sut4KeJ4DH', 'NVO4etyoNx', 'PA047gnhPe', 'yCA4tPmLFn', 'NVp4HpoKyC', 'Ebw4Z1ebnZ', 'sCs4YrwrqI'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nIZjT41dYUX23CleyT.cs High entropy of concatenated method names: 'SnXFlWS2UG', 'AyaFBAWhW8', 'BypFrojx4u', 'uIHFP6sISb', 'C3bFixMA9I', 'yFNF9E6hFn', 'UFkFXiPDbr', 'eFDFkZU7mU', 'lEZF0KuY5m', 'BUKFqU1nPG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, HDAe46A2O6fF0GX7vE.cs High entropy of concatenated method names: 'CbFLC7kTI7', 'CfPLs2xjxu', 'wIeL4SnWyK', 'e2yLNv8ENY', 'TdMLGGH3iD', 'SG7LFTibTy', 'CybLVcKHjY', 'vxGLm8du6p', 'PuGLUGNTKM', 'aJgLS3G1L9'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, l33W9b55KZlmGgZZfOs.cs High entropy of concatenated method names: 'ToString', 'gNp3JLDgqY', 'NBd35L6JMk', 'dKm3R52w7F', 'McF3CCqiHI', 'vuW3s9hcrZ', 'gXt34o9f0C', 'dQx3NfuSva', 'Lat0GLFrDZVByffRPNb', 'VNAPKiFtZypWVKxQwZm'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, uhS9RZ5ahWF0HqJupPq.cs High entropy of concatenated method names: 'bT3hllU7bm', 'riFhBPMJj4', 'BWkhrcPq6D', 'gWxhP1CnkK', 'bRNhiDwCFY', 'tCYh9GJi6I', 'pMRhXQs52t', 'wR0hkdx87w', 'uhoh0ElEX5', 'hAahqumiXV'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, mnZWJCLmR68gF25k1b.cs High entropy of concatenated method names: 'ektEMLI7i1', 'NPOEnYTQ6u', 'IogLuOZpJG', 'oP6LvwT5cX', 'DItEDmUFmj', 'y4qEgkEiGO', 'PCpExVbt4e', 'O25E2rZJ8U', 'hfpE6frD0Z', 'bNcE19aM3V'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nNpPf2bbiU0wr5aAbG.cs High entropy of concatenated method names: 'tJRGRppK14', 'KQ6Gscq9nC', 'Aw9GNvOMqU', 'tdxGFBqoCC', 'sf2GVJNRk1', 'slfNd9Y4M5', 'BKTNTEIoXV', 'raCNaItRTA', 'qPuNMpb1li', 'uoFNj2jhRw'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs High entropy of concatenated method names: 'pZeJRwNh2J', 'BlsJCUKBu2', 'mtDJsoE9gD', 'ybTJ4584LE', 'SUXJNKU7EM', 'vDFJGXmog0', 'ge8JFWUm4L', 'cysJVjHT6L', 'vuKJmO8QX7', 'yxoJU4C5Mf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, sMffnmzUkmObinjZBa.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DuqhO678ql', 'svQh8yDKvO', 'uiIhph5941', 'urhhEKAGJX', 'FskhLhjcvS', 'vhXhhTkTrL', 'IdDh341Q5i'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, j1GIrwPHgpSbc4PlfT.cs High entropy of concatenated method names: 'NXCLy4vJ15', 'DFjLcRAklq', 'JhYLQOFx6s', 'j4pLKWHI7c', 'JP1L29CoYY', 'ivwLe24UBS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, jwCfPD5VUsRfBbdgXYY.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LMU32Gy81E', 'VJy36eEJRV', 'fgM31Pfw61', 'b2Z3ooitw5', 'rdi3dMVCrd', 'DOZ3ToEYNX', 'U1f3ap0T89'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, dakg5lc8YcgJC3pGDS.cs High entropy of concatenated method names: 'lePvFRIqSx', 'c9hvV9VkPp', 'iBcvUhBxTs', 'mxCvSbavG5', 'IH3v8OBY0Q', 'KVYvpUnBfd', 'WE6VVmIR9HqicFOc58', 'rOxHNId5OOW8VoUcUp', 'iTovvgOlHw', 'La7vJ753jb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, wBrAhgpZKKs8gFMTeX.cs High entropy of concatenated method names: 'rhurNtPmf', 'Bw0PyZ1Mv', 's6g9tv3f0', 'X5UXnJ8aR', 'vtV0N97Io', 'IUjqK3unb', 'RRP6f4XvZxghQE4Zun', 'zxSjGJqkJljY7ZFRtM', 'Vv9Ly93yF', 'tvl3jahZF'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nv7pDIdaGY08lNoLhp.cs High entropy of concatenated method names: 'Dispose', 'ptOvjw0vRq', 'AjebcTD0Y4', 'fhvIIrHU6h', 'iFQvnM6hpK', 'fkUvzK4eqi', 'ProcessDialogKey', 's9gbucpt7e', 'AShbvSd6kj', 'UOhbb4MUYb'

Persistence and Installation Behavior
barindex
Yara detected Neshta
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR
Drops PE files with a suspicious file extension
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Windows\svchost.com Jump to dropped file
Drops executable to a common third party application directory
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Infects executable files (exe, dll, sys, html)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Users\user\AppData\Local\Temp\chrome.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe Jump to behavior
Drops PE files
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Windows\svchost.com Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Users\user\AppData\Local\Temp\chrome.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\Windows\svchost.com Jump to dropped file

Boot Survival
barindex
Yara detected Neshta
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR
Creates an undocumented autostart registry key
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iKHPXKiqI.exe PID: 3748, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 1250000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 2C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 4C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 8030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 9030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: 9200000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: A200000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 2E60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 30C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 2EF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 7E10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 8E10000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 8FC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Memory allocated: 9FC0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5450 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 593 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7502 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Windows\svchost.com Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe TID: 5140 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5696 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3856 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5236 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5704 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00405080 FindFirstFileA,FindNextFileA,FindClose, 10_2_00405080
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00405634 FindFirstFileA,FindNextFileA,FindClose, 10_2_00405634
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00404F6C FindFirstFileA,FindClose, 10_2_00404F6C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004056A7 FindFirstFileA,FindNextFileA,FindClose, 10_2_004056A7
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA, 10_2_00406D40
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\ Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\ Jump to behavior
Source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Process queried: DebugPort
Enables debug privileges
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe" Jump to behavior
Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe Jump to dropped file
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Memory written: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" Jump to behavior
Source: AutoIt3_x64.exe.10.dr Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: GetLocaleInfoA, 10_2_00403CB4
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Queries volume information: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_004057D8 GetLocalTime, 10_2_004057D8
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Code function: 10_2_00403D7D GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId, 10_2_00403D7D
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
Yara detected Neshta
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
Yara detected Credential Stealer
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
Yara detected Telegram RAT
Source: Yara match File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1518504 Sample: Plat#U0103 revizuit#U0103_s... Startdate: 25/09/2024 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 15 other signatures 2->53 7 Plat#U0103 revizuit#U0103_shrunk.exe 7 2->7         started        11 iKHPXKiqI.exe 2->11         started        process3 file4 33 C:\Users\user\AppData\Roaming\iKHPXKiqI.exe, PE32 7->33 dropped 35 C:\Users\user\AppData\Local\...\tmpAD6D.tmp, XML 7->35 dropped 37 Plat#U0103 revizuit#U0103_shrunk.exe.log, ASCII 7->37 dropped 55 Adds a directory exclusion to Windows Defender 7->55 57 Injects a PE file into a foreign processes 7->57 13 Plat#U0103 revizuit#U0103_shrunk.exe 5 7->13         started        17 powershell.exe 23 7->17         started        19 powershell.exe 23 7->19         started        23 2 other processes 7->23 21 WerFault.exe 11->21         started        signatures5 process6 file7 39 C:\Windows\svchost.com, PE32 13->39 dropped 41 C:\Users\user\AppData\Local\Temp\chrome.exe, PE32 13->41 dropped 43 C:\ProgramData\...\VC_redist.x64.exe, PE32 13->43 dropped 45 172 other malicious files 13->45 dropped 59 Creates an undocumented autostart registry key 13->59 61 Drops executable to a common third party application directory 13->61 63 Infects executable files (exe, dll, sys, html) 13->63 65 Loading BitLocker PowerShell Module 17->65 25 conhost.exe 17->25         started        27 WmiPrvSE.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 23->31         started        signatures8 process9
⊘No contacted IP infos