Edit tour

Windows Analysis Report
Plat#U0103 revizuit#U0103_shrunk.exe

Overview

General Information

Sample name:	Plat#U0103 revizuit#U0103_shrunk.exe renamed because original name is a hash value
Original sample name:	Plat revizuit_shrunk.exe
Analysis ID:	1518504
MD5:	8eca59816dc6007ae4a40dc09ac5b66f
SHA1:	7ab4088c162ad70f5456dacd1fe34150e22f9e0d
SHA256:	d4f4ad6ea2e448166edde53a24011ddc5c4e870f7c571f9dd5e390e582ca3d33
Tags:	exeuser-malrpt
Infos:

Detection

AgentTesla, Neshta

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Neshta

Yara detected Telegram RAT

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Plat#U0103 revizuit#U0103_shrunk.exe (PID: 3380 cmdline: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" MD5: 8ECA59816DC6007AE4A40DC09AC5B66F)

powershell.exe (PID: 5076 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6568 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1088 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6500 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Plat#U0103 revizuit#U0103_shrunk.exe (PID: 5256 cmdline: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" MD5: 8ECA59816DC6007AE4A40DC09AC5B66F)

Plat#U0103 revizuit#U0103_shrunk.exe (PID: 4836 cmdline: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe" MD5: 8ECA59816DC6007AE4A40DC09AC5B66F)

iKHPXKiqI.exe (PID: 3748 cmdline: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe MD5: 8ECA59816DC6007AE4A40DC09AC5B66F)

WerFault.exe (PID: 3192 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage?chat_id=-4166410344"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: iKHPXKiqI.exe PID: 3748	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa0e0:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa1a8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
10.2.Plat#U0103 revizuit#U0103_shrunk.exe.40a698.1.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xde48:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xdf10:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xcf0ca:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xcf13c:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xcf1c6:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xcf258:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xcf2c2:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xcf334:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xcf3ca:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xcf45a:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack	MALWARE_Win_Neshta	Detects Neshta	ditekSHen	0xa5500:$s1: Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus. 0xa55c8:$s2: ! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ParentImage: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe, ParentProcessId: 3380, ParentProcessName: Plat#U0103 revizuit#U0103_shrunk.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ProcessId: 5076, ProcessName: powershell.exe

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\svchost.com "%1" %*, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe, ProcessId: 4836, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ParentImage: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe, ParentProcessId: 3380, ParentProcessName: Plat#U0103 revizuit#U0103_shrunk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", ProcessId: 6500, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ParentImage: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe, ParentProcessId: 3380, ParentProcessName: Plat#U0103 revizuit#U0103_shrunk.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ProcessId: 5076, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe", ParentImage: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe, ParentProcessId: 3380, ParentProcessName: Plat#U0103 revizuit#U0103_shrunk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp", ProcessId: 6500, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: powershell.exe.6568.5.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage?chat_id=-4166410344"}
Source: Plat#U0103 revizuit#U0103_shrunk.exe.3380.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/sendMessage"}

Multi AV Scanner detection for submitted file

Source: Plat#U0103 revizuit#U0103_shrunk.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Joe Sandbox ML: detected

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.10.dr
Source:	Binary string: NisSrv.pdb source: NisSrv.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.10.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WmQc.pdbs\WmQc.pdbpdbmQc.pdbg\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP^o(C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.10.dr
Source:	Binary string: \??\C:\Windows\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdbOGP source: setup.exe.10.dr
Source:	Binary string: C:\Windows\WmQc.pdbpdbmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: WmQc.pdb^1w^ source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdb source: NAMECONTROLSERVER.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.10.dr
Source:	Binary string: WmQc.pdb21-2246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32EW source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbE source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @jo.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb} source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ker.pdb source: OfficeScrBroker.exe.10.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbZ source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.10.dr
Source:	Binary string: WmQc.pdbSHA256 source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source:	Binary string: symbols\exe\WmQc.pdbjo source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.10.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.10.dr
Source:	Binary string: ?joC:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\WmQc.pdbe source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdbker.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OfficeScrBroker.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb source: ORGCHART.EXE.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdb source: setup.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ORGCHART.EXE.10.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbP source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.10.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source:	Binary string: \??\C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.10.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb.1D source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdb source: PerfBoost.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.10.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SCANPST.EXE.10.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source:	Binary string: T.pdb source: SELFCERT.EXE.10.dr
Source:	Binary string: in32.pdb source: officeappguardwin32.exe.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source:	Binary string: WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\WmQc.pdbj source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdb source: OfficeScrBroker.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: NisSrv.pdbGCTL source: NisSrv.exe0.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: PerfBoost.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: NAMECONTROLSERVER.EXE.10.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb source: SCANPST.EXE.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.10.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp

Spreading

Yara detected Neshta

Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00405080 FindFirstFileA,FindNextFileA,FindClose,	10_2_00405080
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00405634 FindFirstFileA,FindNextFileA,FindClose,	10_2_00405634
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404F6C FindFirstFileA,FindClose,	10_2_00404F6C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004056A7 FindFirstFileA,FindNextFileA,FindClose,	10_2_004056A7

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Code function: 10_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA,

10_2_00406D40

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match

File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE

Source: SELFCERT.EXE.10.dr	String found in binary or memory: http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NisSrv.exe0.10.dr	String found in binary or memory: http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00https://F
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 0000000A.00000002.2664741761.0000000001130000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2322866054.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/
Source: SPREADSHEETCOMPARE.EXE.10.dr	String found in binary or memory: http://tempuri.org/DataSet1.xsd
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUser
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/DisableUserResponse
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUser
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/EnableUserResponse
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfig
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/GetConfigResponse
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettings
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettings
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse
Source: officeappguardwin32.exe.10.dr	String found in binary or memory: http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R
Source: Aut2exe.exe.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/8
Source: AutoIt3_x64.exe.10.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: jp2launcher.exe.10.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: OcPubMgr.exe.10.dr	String found in binary or memory: http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/
Source: pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: NisSrv.exe0.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: NisSrv.exe0.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: NisSrv.exe0.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: FLTLDR.EXE.10.dr

Binary or memory string: RegisterRawInputDevices

memstr_c04288df-1

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.40a698.1.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Neshta Author: ditekSHen

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File created: C:\Windows\svchost.com

Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_012CDEEC	0_2_012CDEEC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07164510	0_2_07164510
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07166580	0_2_07166580
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07166148	0_2_07166148
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_0716D148	0_2_0716D148
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07166E58	0_2_07166E58
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07166E48	0_2_07166E48
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_07164948	0_2_07164948
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_02ECDEEC	11_2_02ECDEEC
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_054D0040	11_2_054D0040
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_054D0006	11_2_054D0006
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C6E58	11_2_071C6E58
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C6E48	11_2_071C6E48
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C4510	11_2_071C4510
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C6580	11_2_071C6580
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C4948	11_2_071C4948
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C6148	11_2_071C6148

Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748

Source: msedgewebview2.exe.10.dr	Static PE information: No import functions for PE file found
Source: msedge_proxy.exe.10.dr	Static PE information: No import functions for PE file found

Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename1dc79151-ab82-45c7-a1ea-3f75fbff36ed.exe4 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2201009082.0000000000D0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2221290682.0000000007E50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename1dc79151-ab82-45c7-a1ea-3f75fbff36ed.exe4 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2216989105.0000000006F7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename;' vs Plat#U0103 revizuit#U0103_shrunk.exe
Source: Plat#U0103 revizuit#U0103_shrunk.exe	Binary or memory string: OriginalFilenameWmQc.exe> vs Plat#U0103 revizuit#U0103_shrunk.exe

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.40a698.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Neshta author = ditekSHen, description = Detects Neshta

Source: Plat#U0103 revizuit#U0103_shrunk.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iKHPXKiqI.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, EWBDlTwtvjH60TEEpY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, EWBDlTwtvjH60TEEpY.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: OfficeScrBroker.exe.10.dr	Binary string: NtCreateFilentdll.dll\Device\Afd\WepollNtWaitForKeyedEventNtCreateKeyedEventRtlNtStatusToDosErrorNtDeviceIoControlFileNtReleaseKeyedEventtcpwsipcudp%s (%s:%d)
Source: MpCmdRun.exe2.10.dr	Binary string: IdImageFileNameFirst Resource TypeTypeScan SourceFirst Resource PathuserIdResource CountReasonProcessMessagePIDStartStopDataIsSignedFile\Device\\\?\\FI_UNKNOWN\drivers\error: invalid data: System Windows path changed during the trace from "%ls" to "%ls"

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@19/195@0/0

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3816:120:WilError_03
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4560:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3748

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File created: C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp

Jump to behavior

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Plat#U0103 revizuit#U0103_shrunk.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File read: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe C:\Users\user\AppData\Roaming\iKHPXKiqI.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static file information: File size 1592832 > 1048576

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdb source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb@@4 source: jp2launcher.exe.10.dr
Source:	Binary string: NisSrv.pdb source: NisSrv.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdb source: SELFCERT.EXE.10.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WmQc.pdbs\WmQc.pdbpdbmQc.pdbg\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: HP^o(C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\SpreadsheetCompare.pdb source: SPREADSHEETCOMPARE.EXE.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OSE.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdb source: officeappguardwin32.exe.10.dr
Source:	Binary string: \??\C:\Windows\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdbOGP source: setup.exe.10.dr
Source:	Binary string: C:\Windows\WmQc.pdbpdbmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: WmQc.pdb^1w^ source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdb source: NAMECONTROLSERVER.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.10.dr
Source:	Binary string: WmQc.pdb21-2246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32EW source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbE source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @jo.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb} source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ker.pdb source: OfficeScrBroker.exe.10.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.10.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbZ source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.10.dr
Source:	Binary string: WmQc.pdbSHA256 source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source:	Binary string: symbols\exe\WmQc.pdbjo source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: r.pdb source: AppSharingHookController.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb source: OcPubMgr.exe.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.10.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb source: jp2launcher.exe.10.dr
Source:	Binary string: ?joC:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\WmQc.pdbe source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdbker.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OfficeScrBroker.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb source: ORGCHART.EXE.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\setup.exe.pdb source: setup.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\orgchart.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: ORGCHART.EXE.10.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbP source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\delivery\x-none\ose.pdb source: OSE.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\selfcert.pdbT.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SELFCERT.EXE.10.dr
Source:	Binary string: MpCmdRun.pdbGCTL source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source:	Binary string: \??\C:\Windows\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.10.dr
Source:	Binary string: MpCmdRun.pdb source: MpCmdRun.exe1.10.dr, MpCmdRun.exe0.10.dr, MpCmdRun.exe2.10.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb.1D source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdb source: PerfBoost.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdbd source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\ocpubmgr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: OcPubMgr.exe.10.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\iKHPXKiqI.PDB source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SCANPST.EXE.10.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.10.dr
Source:	Binary string: T.pdb source: SELFCERT.EXE.10.dr
Source:	Binary string: in32.pdb source: officeappguardwin32.exe.10.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\pwahelper.exe.pdbOGP source: pwahelper.exe1.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr
Source:	Binary string: WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001405000.00000004.00000020.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2317304776.0000000000DD7000.00000004.00000010.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\WmQc.pdbj source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officescrbroker.pdb source: OfficeScrBroker.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\officeappguardwin32.pdbin32.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: officeappguardwin32.exe.10.dr
Source:	Binary string: MicrosoftEdgeUpdateCore_unsigned.pdb source: MicrosoftEdgeUpdateCore.exe.10.dr
Source:	Binary string: NisSrv.pdbGCTL source: NisSrv.exe0.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2318435074.0000000001373000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: MsMpEng.exe0.10.dr, MsMpEng.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\perfboost.pdbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: PerfBoost.exe.10.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\namecontrolserver.pdbb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: NAMECONTROLSERVER.EXE.10.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007B0E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\scanpst.pdb source: SCANPST.EXE.10.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.10.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\WmQc.pdb source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Plat#U0103 revizuit#U0103_shrunk.exe, MainForm.cs	.Net Code: InitializeComponent
Source: iKHPXKiqI.exe.0.dr, MainForm.cs	.Net Code: InitializeComponent
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	.Net Code: A4fr1GoWJPe2RT1Dwen System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	.Net Code: A4fr1GoWJPe2RT1Dwen System.Reflection.Assembly.Load(byte[])
Source: msedge_proxy.exe.10.dr, MainForm.cs	.Net Code: InitializeComponent

Source: Plat#U0103 revizuit#U0103_shrunk.exe

Static PE information: 0xC91F9674 [Fri Dec 4 06:55:48 2076 UTC]

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_012CE02D push ebp; retn 0002h	0_2_012CE032
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_012CAFCA push esi; iretd	0_2_012CAFCB
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 0_2_0716419D push B9FFFFFFh; ret	0_2_071641A2
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_0040802C push 00408052h; ret	10_2_0040804A
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004070A4 push 004070D0h; ret	10_2_004070C8
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004041D8 push 00404204h; ret	10_2_004041FC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004041A0 push 004041CCh; ret	10_2_004041C4
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404256 push 00404284h; ret	10_2_0040427C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404258 push 00404284h; ret	10_2_0040427C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404210 push 0040423Ch; ret	10_2_00404234
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004042C8 push 004042F4h; ret	10_2_004042EC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404290 push 004042BCh; ret	10_2_004042B4
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404370 push 0040439Ch; ret	10_2_00404394
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404300 push 0040432Ch; ret	10_2_00404324
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404338 push 00404364h; ret	10_2_0040435C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004043E0 push 0040440Ch; ret	10_2_00404404
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004043A8 push 004043D4h; ret	10_2_004043CC
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00406CE0 push 00406D36h; ret	10_2_00406D2E
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_0040DCAC push ss; iretd	10_2_0040DD4C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00403D28 push 00403D79h; ret	10_2_00403D71
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_0040DE43 push cs; iretd	10_2_0040DE4E
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_0040DEF1 push cs; iretd	10_2_0040DF14
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00403F58 push 00403F84h; ret	10_2_00403F7C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_0040DF15 push ss; iretd	10_2_0040DF4A
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00403F90 push 00403FBCh; ret	10_2_00403FB4
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_054DEB08 pushfd ; iretd	11_2_054DEB09
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Code function: 11_2_071C419D push B9FFFFFFh; ret	11_2_071C41A2

Source: Plat#U0103 revizuit#U0103_shrunk.exe	Static PE information: section name: .text entropy: 7.864633377561674
Source: iKHPXKiqI.exe.0.dr	Static PE information: section name: .text entropy: 7.864633377561674

Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c8a258.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2c7da30.3.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, i3QFsjjoAPkUndGBmc.cs	High entropy of concatenated method names: 'nxBhvINf01', 'JM5hJVYI0G', 'xkyh5PXUgn', 'DFJhC5ZybL', 'RebhsmNwGI', 'iF3hNIpSUS', 'vmkhGGiMUL', 'AWnLaUPho5', 'QsULMQN5ay', 'hhDLjgUMCR'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, lympCmhAo8DkBB5YJn.cs	High entropy of concatenated method names: 'bCrOkBj3yF', 'lQUO06s2Un', 'RpHOy05m9w', 'JyKOcc9mZl', 'GXXOKH4pcU', 'R6FOeL3XCN', 'qBKOtvRvS6', 'Ge9OH13XRJ', 'CGsOYrVOF5', 'sJxODRq5NA'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Ev4NU9fl0WsJ9RcSij.cs	High entropy of concatenated method names: 'TsKEUapl2Y', 'jVwESIyy1n', 'ToString', 'M0MECN8NWQ', 'q1ZEsCsu0i', 'J09E48r9q1', 'WYKENl8E8n', 'paVEGsDPgw', 'gBZEFn2Jgh', 'aMDEVMp6JD'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, EWBDlTwtvjH60TEEpY.cs	High entropy of concatenated method names: 'V9hs202UtI', 'sIAs6dkNkR', 'lyTs1aJDbd', 'b5IsosevID', 'HYYsdq58oj', 'T1WsT9MWZ3', 'tpUsa0w3Q4', 'YHisMRBWwf', 'gAYsj4tOJP', 't0Rsn7M02o'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, dHK0JAuufJel4uCYfC.cs	High entropy of concatenated method names: 'leM4PP1phQ', 'AeU49aHpqw', 'DId4kS12me', 'yNb40SQfX7', 'fag48WwoFd', 'qM74pIsRni', 'Hm24E47CPI', 'loJ4Lm9YO0', 'rGL4hSDSqC', 'xeI43pJhBf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, lbaPktE2bTWtbRkDt5.cs	High entropy of concatenated method names: 'fO0FCfV5kk', 'n8VF4mcPfI', 'jvJFGMXW5B', 'jUqGnuhGS0', 'sxxGzlKef0', 'NytFuOeJJg', 'l5dFvxweGj', 'fLfFbECSmX', 'wytFJbRSIg', 'FXvF5UFpKL'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, qodqsKeqLvo5DFFps0.cs	High entropy of concatenated method names: 'R7BNi9Opoc', 'rx8NXlbyXH', 'EOU4Q10dXb', 'Sut4KeJ4DH', 'NVO4etyoNx', 'PA047gnhPe', 'yCA4tPmLFn', 'NVp4HpoKyC', 'Ebw4Z1ebnZ', 'sCs4YrwrqI'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nIZjT41dYUX23CleyT.cs	High entropy of concatenated method names: 'SnXFlWS2UG', 'AyaFBAWhW8', 'BypFrojx4u', 'uIHFP6sISb', 'C3bFixMA9I', 'yFNF9E6hFn', 'UFkFXiPDbr', 'eFDFkZU7mU', 'lEZF0KuY5m', 'BUKFqU1nPG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, HDAe46A2O6fF0GX7vE.cs	High entropy of concatenated method names: 'CbFLC7kTI7', 'CfPLs2xjxu', 'wIeL4SnWyK', 'e2yLNv8ENY', 'TdMLGGH3iD', 'SG7LFTibTy', 'CybLVcKHjY', 'vxGLm8du6p', 'PuGLUGNTKM', 'aJgLS3G1L9'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, l33W9b55KZlmGgZZfOs.cs	High entropy of concatenated method names: 'ToString', 'gNp3JLDgqY', 'NBd35L6JMk', 'dKm3R52w7F', 'McF3CCqiHI', 'vuW3s9hcrZ', 'gXt34o9f0C', 'dQx3NfuSva', 'Lat0GLFrDZVByffRPNb', 'VNAPKiFtZypWVKxQwZm'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, uhS9RZ5ahWF0HqJupPq.cs	High entropy of concatenated method names: 'bT3hllU7bm', 'riFhBPMJj4', 'BWkhrcPq6D', 'gWxhP1CnkK', 'bRNhiDwCFY', 'tCYh9GJi6I', 'pMRhXQs52t', 'wR0hkdx87w', 'uhoh0ElEX5', 'hAahqumiXV'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, mnZWJCLmR68gF25k1b.cs	High entropy of concatenated method names: 'ektEMLI7i1', 'NPOEnYTQ6u', 'IogLuOZpJG', 'oP6LvwT5cX', 'DItEDmUFmj', 'y4qEgkEiGO', 'PCpExVbt4e', 'O25E2rZJ8U', 'hfpE6frD0Z', 'bNcE19aM3V'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nNpPf2bbiU0wr5aAbG.cs	High entropy of concatenated method names: 'tJRGRppK14', 'KQ6Gscq9nC', 'Aw9GNvOMqU', 'tdxGFBqoCC', 'sf2GVJNRk1', 'slfNd9Y4M5', 'BKTNTEIoXV', 'raCNaItRTA', 'qPuNMpb1li', 'uoFNj2jhRw'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	High entropy of concatenated method names: 'pZeJRwNh2J', 'BlsJCUKBu2', 'mtDJsoE9gD', 'ybTJ4584LE', 'SUXJNKU7EM', 'vDFJGXmog0', 'ge8JFWUm4L', 'cysJVjHT6L', 'vuKJmO8QX7', 'yxoJU4C5Mf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, sMffnmzUkmObinjZBa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DuqhO678ql', 'svQh8yDKvO', 'uiIhph5941', 'urhhEKAGJX', 'FskhLhjcvS', 'vhXhhTkTrL', 'IdDh341Q5i'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, j1GIrwPHgpSbc4PlfT.cs	High entropy of concatenated method names: 'NXCLy4vJ15', 'DFjLcRAklq', 'JhYLQOFx6s', 'j4pLKWHI7c', 'JP1L29CoYY', 'ivwLe24UBS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, jwCfPD5VUsRfBbdgXYY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LMU32Gy81E', 'VJy36eEJRV', 'fgM31Pfw61', 'b2Z3ooitw5', 'rdi3dMVCrd', 'DOZ3ToEYNX', 'U1f3ap0T89'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, dakg5lc8YcgJC3pGDS.cs	High entropy of concatenated method names: 'lePvFRIqSx', 'c9hvV9VkPp', 'iBcvUhBxTs', 'mxCvSbavG5', 'IH3v8OBY0Q', 'KVYvpUnBfd', 'WE6VVmIR9HqicFOc58', 'rOxHNId5OOW8VoUcUp', 'iTovvgOlHw', 'La7vJ753jb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, wBrAhgpZKKs8gFMTeX.cs	High entropy of concatenated method names: 'rhurNtPmf', 'Bw0PyZ1Mv', 's6g9tv3f0', 'X5UXnJ8aR', 'vtV0N97Io', 'IUjqK3unb', 'RRP6f4XvZxghQE4Zun', 'zxSjGJqkJljY7ZFRtM', 'Vv9Ly93yF', 'tvl3jahZF'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, nv7pDIdaGY08lNoLhp.cs	High entropy of concatenated method names: 'Dispose', 'ptOvjw0vRq', 'AjebcTD0Y4', 'fhvIIrHU6h', 'iFQvnM6hpK', 'fkUvzK4eqi', 'ProcessDialogKey', 's9gbucpt7e', 'AShbvSd6kj', 'UOhbb4MUYb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.5360000.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2cd9b3c.1.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, kD0JNdgNBriBGn5egS.cs	High entropy of concatenated method names: 'ubU6vJppswKkZ', 'uvAmfDYbimWPg9rmyH6', 'XHYItoYHo1DoUvgeuNZ', 'tYVkNWYXlYIi7gDFfLn', 'TV4H82YzoL7kT86loIA', 'yoiEG7M3KqRFDlQAaqW', 'rU4RpWYS77WPQpUZwKR', 'vGvSIFYGEhSitdykOPg', 'TCSl6vMYjB5c5h75h4u'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.2ccc98c.2.raw.unpack, QBy45BY4uMbUQs88Qq.cs	High entropy of concatenated method names: 'QByY45B4u', 'EbUNQs88Q', 'D8PguGCCm', 'gfwtorebq', 'rQ9oD0JNd', 'cBrXiBGn5', 'sgS08fT72', 'lmAQKmrG6', 'qn1mTNvNO', 'K084ZL4CG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, i3QFsjjoAPkUndGBmc.cs	High entropy of concatenated method names: 'nxBhvINf01', 'JM5hJVYI0G', 'xkyh5PXUgn', 'DFJhC5ZybL', 'RebhsmNwGI', 'iF3hNIpSUS', 'vmkhGGiMUL', 'AWnLaUPho5', 'QsULMQN5ay', 'hhDLjgUMCR'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, lympCmhAo8DkBB5YJn.cs	High entropy of concatenated method names: 'bCrOkBj3yF', 'lQUO06s2Un', 'RpHOy05m9w', 'JyKOcc9mZl', 'GXXOKH4pcU', 'R6FOeL3XCN', 'qBKOtvRvS6', 'Ge9OH13XRJ', 'CGsOYrVOF5', 'sJxODRq5NA'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Ev4NU9fl0WsJ9RcSij.cs	High entropy of concatenated method names: 'TsKEUapl2Y', 'jVwESIyy1n', 'ToString', 'M0MECN8NWQ', 'q1ZEsCsu0i', 'J09E48r9q1', 'WYKENl8E8n', 'paVEGsDPgw', 'gBZEFn2Jgh', 'aMDEVMp6JD'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, EWBDlTwtvjH60TEEpY.cs	High entropy of concatenated method names: 'V9hs202UtI', 'sIAs6dkNkR', 'lyTs1aJDbd', 'b5IsosevID', 'HYYsdq58oj', 'T1WsT9MWZ3', 'tpUsa0w3Q4', 'YHisMRBWwf', 'gAYsj4tOJP', 't0Rsn7M02o'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, dHK0JAuufJel4uCYfC.cs	High entropy of concatenated method names: 'leM4PP1phQ', 'AeU49aHpqw', 'DId4kS12me', 'yNb40SQfX7', 'fag48WwoFd', 'qM74pIsRni', 'Hm24E47CPI', 'loJ4Lm9YO0', 'rGL4hSDSqC', 'xeI43pJhBf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, lbaPktE2bTWtbRkDt5.cs	High entropy of concatenated method names: 'fO0FCfV5kk', 'n8VF4mcPfI', 'jvJFGMXW5B', 'jUqGnuhGS0', 'sxxGzlKef0', 'NytFuOeJJg', 'l5dFvxweGj', 'fLfFbECSmX', 'wytFJbRSIg', 'FXvF5UFpKL'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, qodqsKeqLvo5DFFps0.cs	High entropy of concatenated method names: 'R7BNi9Opoc', 'rx8NXlbyXH', 'EOU4Q10dXb', 'Sut4KeJ4DH', 'NVO4etyoNx', 'PA047gnhPe', 'yCA4tPmLFn', 'NVp4HpoKyC', 'Ebw4Z1ebnZ', 'sCs4YrwrqI'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nIZjT41dYUX23CleyT.cs	High entropy of concatenated method names: 'SnXFlWS2UG', 'AyaFBAWhW8', 'BypFrojx4u', 'uIHFP6sISb', 'C3bFixMA9I', 'yFNF9E6hFn', 'UFkFXiPDbr', 'eFDFkZU7mU', 'lEZF0KuY5m', 'BUKFqU1nPG'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, HDAe46A2O6fF0GX7vE.cs	High entropy of concatenated method names: 'CbFLC7kTI7', 'CfPLs2xjxu', 'wIeL4SnWyK', 'e2yLNv8ENY', 'TdMLGGH3iD', 'SG7LFTibTy', 'CybLVcKHjY', 'vxGLm8du6p', 'PuGLUGNTKM', 'aJgLS3G1L9'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, l33W9b55KZlmGgZZfOs.cs	High entropy of concatenated method names: 'ToString', 'gNp3JLDgqY', 'NBd35L6JMk', 'dKm3R52w7F', 'McF3CCqiHI', 'vuW3s9hcrZ', 'gXt34o9f0C', 'dQx3NfuSva', 'Lat0GLFrDZVByffRPNb', 'VNAPKiFtZypWVKxQwZm'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, uhS9RZ5ahWF0HqJupPq.cs	High entropy of concatenated method names: 'bT3hllU7bm', 'riFhBPMJj4', 'BWkhrcPq6D', 'gWxhP1CnkK', 'bRNhiDwCFY', 'tCYh9GJi6I', 'pMRhXQs52t', 'wR0hkdx87w', 'uhoh0ElEX5', 'hAahqumiXV'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, mnZWJCLmR68gF25k1b.cs	High entropy of concatenated method names: 'ektEMLI7i1', 'NPOEnYTQ6u', 'IogLuOZpJG', 'oP6LvwT5cX', 'DItEDmUFmj', 'y4qEgkEiGO', 'PCpExVbt4e', 'O25E2rZJ8U', 'hfpE6frD0Z', 'bNcE19aM3V'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nNpPf2bbiU0wr5aAbG.cs	High entropy of concatenated method names: 'tJRGRppK14', 'KQ6Gscq9nC', 'Aw9GNvOMqU', 'tdxGFBqoCC', 'sf2GVJNRk1', 'slfNd9Y4M5', 'BKTNTEIoXV', 'raCNaItRTA', 'qPuNMpb1li', 'uoFNj2jhRw'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, Q3cYm63WTXjOtmGRQk.cs	High entropy of concatenated method names: 'pZeJRwNh2J', 'BlsJCUKBu2', 'mtDJsoE9gD', 'ybTJ4584LE', 'SUXJNKU7EM', 'vDFJGXmog0', 'ge8JFWUm4L', 'cysJVjHT6L', 'vuKJmO8QX7', 'yxoJU4C5Mf'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, sMffnmzUkmObinjZBa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DuqhO678ql', 'svQh8yDKvO', 'uiIhph5941', 'urhhEKAGJX', 'FskhLhjcvS', 'vhXhhTkTrL', 'IdDh341Q5i'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, j1GIrwPHgpSbc4PlfT.cs	High entropy of concatenated method names: 'NXCLy4vJ15', 'DFjLcRAklq', 'JhYLQOFx6s', 'j4pLKWHI7c', 'JP1L29CoYY', 'ivwLe24UBS', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, jwCfPD5VUsRfBbdgXYY.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LMU32Gy81E', 'VJy36eEJRV', 'fgM31Pfw61', 'b2Z3ooitw5', 'rdi3dMVCrd', 'DOZ3ToEYNX', 'U1f3ap0T89'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, dakg5lc8YcgJC3pGDS.cs	High entropy of concatenated method names: 'lePvFRIqSx', 'c9hvV9VkPp', 'iBcvUhBxTs', 'mxCvSbavG5', 'IH3v8OBY0Q', 'KVYvpUnBfd', 'WE6VVmIR9HqicFOc58', 'rOxHNId5OOW8VoUcUp', 'iTovvgOlHw', 'La7vJ753jb'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, wBrAhgpZKKs8gFMTeX.cs	High entropy of concatenated method names: 'rhurNtPmf', 'Bw0PyZ1Mv', 's6g9tv3f0', 'X5UXnJ8aR', 'vtV0N97Io', 'IUjqK3unb', 'RRP6f4XvZxghQE4Zun', 'zxSjGJqkJljY7ZFRtM', 'Vv9Ly93yF', 'tvl3jahZF'
Source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.7e50000.6.raw.unpack, nv7pDIdaGY08lNoLhp.cs	High entropy of concatenated method names: 'Dispose', 'ptOvjw0vRq', 'AjebcTD0Y4', 'fhvIIrHU6h', 'iFQvnM6hpK', 'fkUvzK4eqi', 'ProcessDialogKey', 's9gbucpt7e', 'AShbvSd6kj', 'UOhbb4MUYb'

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Boot Survival

Yara detected Neshta

Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: iKHPXKiqI.exe PID: 3748, type: MEMORYSTR

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 8030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 9030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: 9200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Memory allocated: A200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 2E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 30C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 2EF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 7E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 8E10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 8FC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Memory allocated: 9FC0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5450	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 593	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7502	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe TID: 5140	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5236	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00405080 FindFirstFileA,FindNextFileA,FindClose,	10_2_00405080
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00405634 FindFirstFileA,FindNextFileA,FindClose,	10_2_00405634
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_00404F6C FindFirstFileA,FindClose,	10_2_00404F6C
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Code function: 10_2_004056A7 FindFirstFileA,FindNextFileA,FindClose,	10_2_004056A7

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Code function: 10_2_00406D40 GetLogicalDriveStringsA,GetDriveTypeA,

10_2_00406D40

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Config\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\	Jump to behavior

Source: iKHPXKiqI.exe, 0000000B.00000002.2334957405.0000000007AF5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

API call chain: ExitProcess graph end node

graph_10-6162

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"	Jump to behavior

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe			Jump to dropped file

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Memory written: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Process created: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"	Jump to behavior

Source: AutoIt3_x64.exe.10.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Code function: GetLocaleInfoA,

10_2_00403CB4

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Queries volume information: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Code function: 10_2_004057D8 GetLocalTime,

10_2_004057D8

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Code function: 10_2_00403D7D GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

10_2_00403D7D

Source: C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Yara detected Neshta

Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Plat#U0103 revizuit#U0103_shrunk.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 4836, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Plat#U0103 revizuit#U0103_shrunk.exe.3cef6e8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Plat#U0103 revizuit#U0103_shrunk.exe PID: 3380, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	221 Masquerading	11 Input Capture	1 System Time Discovery	1 Taint Shared Content	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	112 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	4 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Plat#U0103 revizuit#U0103_shrunk.exe	29%	ReversingLabs
Plat#U0103 revizuit#U0103_shrunk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/WriteSettings	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe
https://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/DisableUserResponse	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://unitedstates1.ss.wd.microsoft.us/	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/ReadSettings	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/GetConfigResponse	0%	Avira URL Cloud	safe
http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00https://F	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/DisableUser	0%	Avira URL Cloud	safe
http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/GetConfig	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/8	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects	0%	Avira URL Cloud	safe
https://unitedstates2.ss.wd.microsoft.us/	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/EnableUser	0%	Avira URL Cloud	safe
https://unitedstates4.ss.wd.microsoft.us/	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/	0%	Avira URL Cloud	safe
http://tempuri.org/IRoamingSettingsService/EnableUserResponse	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/IRoamingSettingsService/WriteSettings	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	AutoIt3_x64.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.Service	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/DataSet1.xsd	SPREADSHEETCOMPARE.EXE.10.dr	false	Avira URL Cloud: safe	unknown
https://unitedstates1.ss.wd.microsoft.us/	NisSrv.exe0.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/DisableUserResponse	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Plat#U0103 revizuit#U0103_shrunk.exe, 0000000A.00000002.2664741761.0000000001130000.00000004.00000010.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/	Aut2exe.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	Aut2exe.exe.10.dr, AutoIt3_x64.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://xml.org/sax/properties/lexical-handlerhttp://xml.org/sax/features/namespace-prefixeshttp://xm	OcPubMgr.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/WriteSettingsResponse	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/ReadSettings	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00https://F	NisSrv.exe0.10.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjectsItemsSortKeyArrayOfR	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/GetConfig	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/GetConfigResponse	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/WriteSettingshttp://tempuri.org/IRoamingSettingsService/R	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/DisableUser	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://%s/r/rlidVBASelfCert?clid=%d1.3.6.1.5.5.7.3.32.5.29.372.5.29.11.2.840.113549.1.1.5SelfSignedC	SELFCERT.EXE.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/ReadSettingsResponse	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/8	Aut2exe.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/Microsoft.Office.Web.Roaming.SoapObjects	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IRoamingSettingsService/EnableUser	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://unitedstates2.ss.wd.microsoft.us/	NisSrv.exe0.10.dr	false	Avira URL Cloud: safe	unknown
https://unitedstates4.ss.wd.microsoft.us/	NisSrv.exe0.10.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, iKHPXKiqI.exe, 0000000B.00000002.2322866054.0000000003127000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/IRoamingSettingsService/EnableUserResponse	officeappguardwin32.exe.10.dr	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/	Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Plat#U0103 revizuit#U0103_shrunk.exe, 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	pwahelper.exe1.10.dr, setup.exe.10.dr, pwahelper.exe0.10.dr, pwahelper.exe.10.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518504
Start date and time:	2024-09-25 18:50:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Plat#U0103 revizuit#U0103_shrunk.exe renamed because original name is a hash value
Original Sample Name:	Plat revizuit_shrunk.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@19/195@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 148 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Plat#U0103 revizuit#U0103_shrunk.exe

Simulations

Behavior and APIs

Time	Type	Description
12:51:17	API Interceptor	1x Sleep call for process: Plat#U0103 revizuit#U0103_shrunk.exe modified
12:51:19	API Interceptor	33x Sleep call for process: powershell.exe modified
12:51:22	API Interceptor	1x Sleep call for process: iKHPXKiqI.exe modified
12:51:30	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:51:19	Task Scheduler	Run new task: iKHPXKiqI path: C:\Users\user\AppData\Roaming\iKHPXKiqI.exe

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275560
Entropy (8bit):	6.2842915613810275
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYoP5KVkD8QC2mCBFv9m7usyT8tKQ9clyPqlO91/iDVSsWUG0bCP0BwB:WSnRuo4VQjVsxyItKQNhigibKCM
MD5:	80676B77D5DB65D41E1224C987306531
SHA1:	BCD9AAF542D1794C41C0C3B76D10826DEBFB40C0
SHA-256:	C861A15936B6A16F1E78D0FDB9400319F6F270C8B56B2F06FC732E18753BD230
SHA-512:	5CE24774FFDF7A7AAC432045D438FB2C8924C5D74D9D6AFE3175330226F34B85C28EFCBFC52D68823448D76E4769130B3486E6DD4F70584A356D1CE9D36010CC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	217704
Entropy (8bit):	6.575915789545229
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBjsxFVaK4T6fWSlXe0lJQafeyrR0kr/yh5DEU/Pk13TfwqiTP0McBUNd:WSnRBs2K4TSFo5Y683TdiQMcGNUl4N
MD5:	BCBACCE33D80120F77857797ED156A81
SHA1:	25BC486A21A274FB9D0602164196F7D307037215
SHA-256:	3F2698FF7D84A26E3054B9B20E0C73483A698609ED1EE91457E0BD5A282C9645
SHA-512:	CAB77360CE0A8FF71BF50098A9A8EEB8F0C834E75BC0D244BEFFF00FADB5346696D8BD1F30A0ECBD7BA3237EAE75FF825D0CE5D8D81F4F4E4F708120CC06EB4D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	237160
Entropy (8bit):	6.392464580443512
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBjvyRnuBGwl/1Gc9QnvGqyWQ93kr/yh5DEU/P5kP0zU35iuvQBUeGMLu:WSnRBKl3wdYtcH9b5Y651zU77Ea
MD5:	7880D3B9847A88ACA25AF723DC6B52FA
SHA1:	B454B2537C4812AC4DF43DBCEB134572DDF0649B
SHA-256:	B5DED33C7C422FD7EDD69764C459A1D2519663BA7A68BD452A6A4D94336AB74C
SHA-512:	0DEF04E92BDAB3A8E32E2BF1196DBF05FD933E57288DA9E8C3A79D8FA50A9841041290E549AAA30F1F45BC6B26EB1837D5E6CFFBFF702B74D7A8892B4BE2EA32
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1675872
Entropy (8bit):	7.4529297313050575
Encrypted:	false
SSDEEP:	24576:kaC51xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+l:kNK0eqkSR7Xgo4TiRPnLWvJY
MD5:	68AC3EAFE18726679CAC197B308880A4
SHA1:	46D10F7B952B181B4E60DBE405468C89F7E39E5E
SHA-256:	51FE72DF38F04A8415B43D920C3098F9F9981EEE18BC495199F84092254A02FE
SHA-512:	B43732A950A3A6B8EA2832A1C3FACA09476B21F4934D87546A1B7B5A4541BCA0C04B60E996B2E63A7C6431CEED8DA1B96648EC5B2CC6B6B211A9E32E84154471
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1841760
Entropy (8bit):	7.344196746200683
Encrypted:	false
SSDEEP:	24576:kOEeK2NocwiN/jc41p3qp11JsqbhOUe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+i:kifYP1JsEDkSR7Xgo4TiRPnLWvJD
MD5:	EAD10CB989CB5F29BE738D613CD6B7D6
SHA1:	F3570A2AE2724E1710DC01F253C12B912B5DEABF
SHA-256:	4164BF8AB6FC3B190047C7137FCDB3DFF4B06FB0ECADBFB58655C14D01263442
SHA-512:	F18837FB28F1B7BF7AF6A74D6284253A3B872B37FC0CBB9EF6F6818CE3602109E5417CF473ED42CF0ACCDF2262B106F515547FD5DFB6575DB98E98AF8842A644
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	7.869312268037642
Encrypted:	false
SSDEEP:	6144:WSnRuEpXDXz7yIrozs0WuNd3ojusBdgnNW6r4F53ttuGENGFdVCLEYnPO1D7YYoR:lRuE9zGImAjJdcH4j3ttzFdVCLNSfHoR
MD5:	C38FB795BF7D3EA81D3BAF8F8695B982
SHA1:	E73BD80735FA773E3A7E010F7CAA1BA78625A013
SHA-256:	594242FC3BA80099CA29498B9526DFC419DBAE2A9FBB4044D1DDDFBB20589E17
SHA-512:	07F7461ED28F4789DC0E64291211FFC4E5D3EE32AB15041F2AF24A44571017C7FFBFD595991EF22C133856C140B313122D451FB043FDF66F9FEC6680DBB68A3E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	165976
Entropy (8bit):	6.075066762314893
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBZkakvQ4gXIRSG+7IJqC3CJyoDjpBnjkP0XGx2SYg+b/Q+y1s3:WSnRI6nGZLknnj1X62SYdb4I
MD5:	017E8AC82177DC17E54AF84876E8CB6D
SHA1:	D5405C7F2EF13B469550B24D413B07F32273294A
SHA-256:	CD1052BFAAA849EF3FD2AA0282A08A78CCF79008262AED64E14459D61FF193E5
SHA-512:	D64E5609F7CFD5C9D9C68FC9FDE4A01CDAE0A1DDCD5131966F643439CA2760C5A7BC709F075135D2C91B0FDAEAC372D3194BF8965E94E4F12F624B0E7C5C82B4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1113176
Entropy (8bit):	6.4436642207652515
Encrypted:	false
SSDEEP:	24576:FETC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBg:FE+6AqSPyC+NltpScpzbtvpJoMQSq/jH
MD5:	8B02792497F436CB67634371AED79006
SHA1:	AC7CAC7F86E8CE27E3B511555741317E4482643C
SHA-256:	3C14294D6ABC081FEB09A568738157D9DF7E1C73A401E0C998CCD62DF5C0FFE2
SHA-512:	B85393A53345EB9A95A33C09442DA33D2EEE14808739E9F01C458E023D55326667B80F26055A973A7D882382050661449D27DA22F9F8E66154ABD0A103CE52DB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2414080
Entropy (8bit):	6.72928711096209
Encrypted:	false
SSDEEP:	49152:iYaGSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL8:Xm4OEtwiICvYMpfc
MD5:	30E2ACCC384C42DF52D22119A07AE523
SHA1:	43E92879BB25CB65F415BFCAEF77CEEBFE3181BA
SHA-256:	C9BF724414DF8003D62041C20331B52971D2F5D4AB2496858C9FCD7896F0C277
SHA-512:	77B056A5973B7023D0D814D84CE6159C45394D87F788B1E6A709CE12275C56F3F21385E679F12520F9566CED12B9AAAB1BD4EC2270C893FCD7500815AD9FA403
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113233
Entropy (8bit):	6.680209242451468
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB2CrAfGEtajbefY/TU9fE9PEtuGCrK:WSnRUCrAOEt+cYa6YCrK
MD5:	2018DCCCB0A6D58E8E7CF64F44DC1CC9
SHA1:	687904A01464A2430B3DD8596B9CD482886F19AC
SHA-256:	7230AC1DB1771CFDD51656663ADE9E13F4BE29FE01E9DF2E40DBCBA612718E64
SHA-512:	E6139EE551C342128D7BA418BE69BFE70B3A1BB60A813B8CAEB0D772FE8CF3D416C4E83B65D22EC4CF0F990156849BB2907FAAA601A5AE2B8DFF09B0FB2C8364
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	409608
Entropy (8bit):	6.464197829599468
Encrypted:	false
SSDEEP:	6144:WSnRvUvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMWvpBVOaqahUqjAGT:lRvxbgvuFuQdj+zRTJkX8yMhB3jhBAi
MD5:	1A6C7C734D6AA4568D5237864224C7F7
SHA1:	C007E55E95E9FB39BAFF1C927FD6AACAC5C63199
SHA-256:	3FDD011A01F94F43AC9E814D37C647A1D6A2B678FFB37FB27E605F2A0824DE5A
SHA-512:	AF1D3B659366BF48100F9CE20603F30712E660AC153E455683D1D6EEC02DF81AAAD90936DAFBA5F4798A6E1A78F7F4BEC593DFB29E0642F7F7E61026657D4F66
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	6.46869395132032
Encrypted:	false
SSDEEP:	6144:WSnRtMGUcsvZZvUmubv7hTHA8l3yROJyDI5:lRtMGUcsvZZdubv7hfl34I5
MD5:	4852B26F0C156803A5E19E550E3A0B0F
SHA1:	5740B5F5F5F8C9927A42B09536CDFB82A516CE44
SHA-256:	86628CD35C4A9CC95A858A6F8F9150034E3214E83A157263721CE3D3490CA218
SHA-512:	D9C1954037A29B70983CBC05ACEC879FD8D3A637FFD72F549BBF38B2C6EA21FC1E99621AF25D14392B05B2021D6F6DF1DB5DFAACA7B9759A38EA19FBACA7FD8D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	568400
Entropy (8bit):	6.676683211577486
Encrypted:	false
SSDEEP:	12288:lR4oyvTCXdXikLj2jR7trg6Qi3vYsKTU00vq:YoyyLj8trn3wsq0vq
MD5:	86147E63924D2D6DCC485B3CEA310619
SHA1:	951DA8775C4C2EE4510DAF3AA1D01323BCEB239F
SHA-256:	4DB0BDFB7F32BA6054E984A844BE786D536544687E0CE14D390953DEC5F3A31F
SHA-512:	2DC8CEAB6BBCA93723FDEB08E9A2FBDC5698F9D72C0F506F05B6DFFBA8C7797E582F8769D658A73CAB26160E500E2636ABB41C065F0DA7AA58CCF6050F972353
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1252432
Entropy (8bit):	6.757094822185321
Encrypted:	false
SSDEEP:	24576:G40n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/ZeoMOp:GH4iwwGJra0uAUfkVy7/ZX
MD5:	A1836D53CDED2FBCEC3CD9A05187C2A8
SHA1:	4518420E56A84CE8C1C994CB237B3B8661BAF3CA
SHA-256:	AB7E942B567BDCADA5E40022FF9FBB383511684232C77EACE321582259F87354
SHA-512:	DBB6B5573E00A8F17F77C3A7B5C3D592B474B9AEE032DE19F9EF5414C4B50B779B08E21C6E600B94DEDEC40C928389BE6F6F994162FA50EC1129D8F91CF29763
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	790096
Entropy (8bit):	6.738915238666672
Encrypted:	false
SSDEEP:	24576:iYR0gB6axoCfyR6RLQRF/TzJqe58BimIh:iLgHxAR6uBTzge5MimU
MD5:	790AC6249CAC27492EFDE985CC5358FF
SHA1:	63132E992C20062608F057B16724A5BE878FEA09
SHA-256:	715E14BDBF798B2B5B1B9FC9F577CD3728E4704B985327D1C8FF7E073F1330EB
SHA-512:	11E3CA12573367FF48DEF3BFCE33DD3FCCE564F7661922720DB699A736007E45572028B358582DD8015E37C1F8276A6FFEEAB3A6F0420189E25FAE8D1DCB77B2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	562776
Entropy (8bit):	6.406792958360706
Encrypted:	false
SSDEEP:	12288:lRCkeqbWqB3sunrT9+aYFLq3ny7JSEBPj:ikeqbbBcunrTZ3y7kEBPj
MD5:	8D2792110C0B7612643854B4F2903430
SHA1:	4D65DC6B0911D3FAAF85419D527C9ACFDAB3B986
SHA-256:	76A300CBAB272254BE9CE5D8CD4DEAB49749F5DF3AF1B140575C783DAD29A3CC
SHA-512:	7B646CEFA6A8F0AFFF265D1941176292B4864C53F748BE0708BA9C279FB7FB8B4B6D657FBA6F6E76F35508EC570BF0DBC171D7DF0C8D30566463EF6AEE1C370F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	127512
Entropy (8bit):	6.255437261208423
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYsPo10JOSdnvEhEyr1hg9uCRFRzsxeZ:WSnRusg1MOc81hmRFJs0Z
MD5:	2BD622257AE34593FF590BFC355BB274
SHA1:	538B6B45DBE37884B4D3C031917E54DF261D810F
SHA-256:	92850BA39826192E2AC1EBEB94208296C8885E719A1E4A8D708057A087CFB3D9
SHA-512:	07FAD3545507D1D21685FEBBBEE6CF9EF3AFC5F44DFE93B661CA517F1870934356A1C35E4538FE3526BC1C69B63A85FBE64257A69C56AA47F1070F6C4AB75839
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790127185402018
Encrypted:	false
SSDEEP:	6144:WSnRdwGLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:lRdwGEbH0j4x7R6SvyCMqn
MD5:	84697E3967FF4DE10734EC57088F7E24
SHA1:	FC8A4F3E7E87BC4DE8CEE664EEC67A9734ECDCFF
SHA-256:	5C762AD4AF1E58985F8B41B1066F4A88B83D840EEC2B57C1308E4F11A67A0F71
SHA-512:	5DF5329150B7AD695133518C36EACC256B5C554A8FBD4BB27201A2C16E845963F4BCD6EC58F008CE38FE16938828B6C93E088D74BD933D52C7D15DD9264DAD5D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.792540132817011
Encrypted:	false
SSDEEP:	6144:WSnRdwLXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:lRdwLXCs/YAh/elvhI7Wd
MD5:	1342F2190D8D0590075ECDA76B1CFF57
SHA1:	44DDCD44CF74F2C9C92F5EFED30DD428C64562CB
SHA-256:	07F88CB99A8525B3FEF4908AD1C70F18739512E012A5FDCAD78364AD50519BF2
SHA-512:	817D0E45349F98CB760DE0A89C8EDB582DF1583CBF54150426EABDD81DBA8BFF6973491FD538BD19D6E981CCBA6D6449804CB2245A3B19D3F178F0DC15B67D47
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.4190168737794
Encrypted:	false
SSDEEP:	12288:lRdwENKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:GEKiBLZ05jNTmJWExixM
MD5:	4527F57ED683F9DD9CA30B3C7D9355E0
SHA1:	85B0CE781C91FDE5F6988AAC2DE19B412B785DD3
SHA-256:	4C5B7FC243DC4F9CE8944EE251960129175CDC0D1C9112A67490B67EA53B23C5
SHA-512:	A151489D61ECC3A4EB267D4964611D9D9BB0042376C90A7CC9D3FD6A7EB23C38EAC467BEFD8E55500BBEB2F62ECAD783324D440C2B0F45D55D06933376E82399
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	343328
Entropy (8bit):	6.640238258461145
Encrypted:	false
SSDEEP:	6144:WSnRqVkTpB8HHvBjruphfgesnAhAOQp2EwckjQx+m8zhPLlZp3:lRqVklinJruphfg26p2Ewix+m8Nln3
MD5:	12717EDA919DFD6C9391DDCE984EB984
SHA1:	34DD5148BEC8148A2FAA31F3B58CA09F72666A0E
SHA-256:	15359C92BEE412BA40EA1F64AE6A0BB47B29A878650F88137FAEB297EB32CEB0
SHA-512:	0A35A764E47C76D3C288C5B5E2F56193ABCF499E97B8D202327657F0B96E3592AE9669A4571EBCE1D8A5659935F535458DEBF55BF73369A5AE6A0D1A0F2B1454
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	443680
Entropy (8bit):	6.381645993742484
Encrypted:	false
SSDEEP:	12288:lRqA3gaHC2zUM2WJoROZVXk8hbodzbaw8x0Cx+wnx:KAx5k8hb0Haw+x5x
MD5:	B10BEA0EA84A17D04B59720014974404
SHA1:	2B69F78CC1B97E21616E0AF9FB0A698D2E489C4E
SHA-256:	3DDA3C17D74E96A3BD41F8906DA5930358E5A9AC73FC50142246C1AE2229B080
SHA-512:	4AFC15DB8B8C2494058FC7F24B1B4F302F5502A912F421956BF266204F59DDB222D6946D364CCE2B415726EC09AFF2227EFD060F262FF8C406F1AC51FC2EC84E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	203552
Entropy (8bit):	6.050724457734535
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB8CaKavT/DvbEvK9aobNI2B+Nl4jz+b0atWH1TmFtotpcat8iKdlVSTB:WSnRqCaK2h9H/B+rEtiPC
MD5:	89864084282F2730096C9431E14CB229
SHA1:	D94B5AAE14E9C4FD0C1EBEE5216B683C041EB08B
SHA-256:	FF431F14DB3B83BD673AB80397224EC75F01852D4344F0AF521FB30F2FDA6172
SHA-512:	49F295A396035ECB7E51AF63EECBD023CDE9B474547398B32005BF1C69D375DCD997006F7418D9C5F5021AC2469A6EA4F5C193BEAE0D6A27EF983968BD744D6F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.4467948670938355
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB834vzT+PjZpsB+2h+EOXkMxJ7Rfp8K172YPrp:WSnRq9psB+09zMH7cCxPd
MD5:	50808BEE5E254DD7954250415439B71A
SHA1:	EC329D3C62C086C96106970652CBF4FF557743C3
SHA-256:	1C88B4912EE70C10221A86BD7314F5B770620830BD2077280902B06F4B442A83
SHA-512:	683CAF1DBAE98A29048BDDDBC65D245D4617C32A0225FCDB7ED468311B2402C4299708B606BE098244D2D3B69A0957F5557B2F2396D153308C10627FF2945DC0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	227104
Entropy (8bit):	6.171026131046213
Encrypted:	false
SSDEEP:	6144:WSnRuKWt9h8QlLISZWVRohcq7dvni3F8QrBA/:lRuKy9hdFIdRoGUxi35rBU
MD5:	A0E7A69400FD13976961FFEB3B5315BD
SHA1:	4CE47A9AA7CAD5185EB32EF9D8A196B1E9C0A43A
SHA-256:	5AF65397BEB3C8BAE0A59AD4C81E4879D762ED787C7499140B170EC7E6283013
SHA-512:	11B55FE869EF0FDB05A7664FEA57A7F70974EB8813EBC441CC060AE54BFBDDADC9CF54628165738E2892A6EA520386855EBA31C5DE2292E256835D1863B5F6BA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.622922766934421
Encrypted:	false
SSDEEP:	6144:WSnRquwCtJmRqyFmB6AOKmiMGwIAfx+iQ+FfFyLgG1da6edo:lRquw6JmRI6Bitwpx+iQafFykG1da6eu
MD5:	FBBF61FD61AC26E9491197AA310EE99C
SHA1:	D55A0C70AAC551DF19837BDA97E8D4C3EA99FA55
SHA-256:	55471AEFCE99F319EF003AA087B863E9841F5742E61FF63385973100F08EB87E
SHA-512:	BEBFA758E859E3A58EA06B53310A1C84E59D531B84CAEED92CD0DB198580134DF769B24637E502BC17E73830F6B3258F054872B3B632BC01560EE1BEEA17B276
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.447178389987601
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB8r4qR8vSZksB+2hdqecER5AhC48S1m2YPrZ:WSnRqhksB+0YlEXAe6QPt
MD5:	5DE3DC0AF919624ACB9134AB65620A3C
SHA1:	089ECE55B5AC4D24250460606CDA85FF8350225E
SHA-256:	C78FB21183060AB949AFDAEB58E2315BF9927BD146B12F11632BA95AAB5427B9
SHA-512:	3ED96802C9A6D15610D3DB4F93467D31ADCE719BADD24B1A2B6615FDC81BDC5BD86A7DCA57698BC440306D3E3367249A801B079F4CF0E5F04CCD6A77E783ABCF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.134\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1631792
Entropy (8bit):	7.969947840830804
Encrypted:	false
SSDEEP:	24576:dzR1kyOX3l3PScicR9iK5vS8dU+0BeId7JfroHKExAuRBAHToF4rMTgZYhA5QR5O:djkVX3lfrFfR0BecCqKBs+4o8YhAKi
MD5:	E65A9E252E826BF7B48EF63454DEF00E
SHA1:	E8975811E5794616AFC44BE7C7752D39EBC671F2
SHA-256:	7A3D3101893713E9D60DCDD5369E51B25C022AE38DF92BE817E831D4D4AA2E25
SHA-512:	1C647159D9D9F72B3BCDCF3A8036A6E36F67F2B8AADE251464FD0BAD3423EF08B2996FFA5F8385DA64B77DAB8F41C56D691427B821F32F6B1D2841777D4B8379
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Google\Update\Install\{EB80938B-EC00-4683-A2CC-456206E3A4E1}\117.0.5938.134_117.0.5938.132_chrome_updater.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1631792
Entropy (8bit):	7.969947840830804
Encrypted:	false
SSDEEP:	24576:dzR1kyOX3l3PScicR9iK5vS8dU+0BeId7JfroHKExAuRBAHToF4rMTgZYhA5QR5O:djkVX3lfrFfR0BecCqKBs+4o8YhAKi
MD5:	E65A9E252E826BF7B48EF63454DEF00E
SHA1:	E8975811E5794616AFC44BE7C7752D39EBC671F2
SHA-256:	7A3D3101893713E9D60DCDD5369E51B25C022AE38DF92BE817E831D4D4AA2E25
SHA-512:	1C647159D9D9F72B3BCDCF3A8036A6E36F67F2B8AADE251464FD0BAD3423EF08B2996FFA5F8385DA64B77DAB8F41C56D691427B821F32F6B1D2841777D4B8379
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790127185402018
Encrypted:	false
SSDEEP:	6144:WSnRdwGLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:lRdwGEbH0j4x7R6SvyCMqn
MD5:	84697E3967FF4DE10734EC57088F7E24
SHA1:	FC8A4F3E7E87BC4DE8CEE664EEC67A9734ECDCFF
SHA-256:	5C762AD4AF1E58985F8B41B1066F4A88B83D840EEC2B57C1308E4F11A67A0F71
SHA-512:	5DF5329150B7AD695133518C36EACC256B5C554A8FBD4BB27201A2C16E845963F4BCD6EC58F008CE38FE16938828B6C93E088D74BD933D52C7D15DD9264DAD5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	135808
Entropy (8bit):	6.29919881430473
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmyrmKueGyeVK7qjh3rmKPNbS7cZPxyqPEoCW/ids8nBs+s8nBs8m:/OSn2M4MBfqRTyutjZqMNbSgxbFrj8m
MD5:	E8166602FFADFF6D2E8A28708C806A67
SHA1:	C173C1DF05E2F601762C901A872B78659AA253D0
SHA-256:	C3928B3C653825FDDC1D07DB4525E7AF918951F1F2EC2DC4B9F5308B242D843B
SHA-512:	6C7E640621433EB9550FD644DA9385AA677F1CA97256329A1FFB64DD43C0559A5390B200383AB7D298E33B74E8C57BD24530958B68FF6863CEF23BFD56E70C83
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.792540132817011
Encrypted:	false
SSDEEP:	6144:WSnRdwLXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:lRdwLXCs/YAh/elvhI7Wd
MD5:	1342F2190D8D0590075ECDA76B1CFF57
SHA1:	44DDCD44CF74F2C9C92F5EFED30DD428C64562CB
SHA-256:	07F88CB99A8525B3FEF4908AD1C70F18739512E012A5FDCAD78364AD50519BF2
SHA-512:	817D0E45349F98CB760DE0A89C8EDB582DF1583CBF54150426EABDD81DBA8BFF6973491FD538BD19D6E981CCBA6D6449804CB2245A3B19D3F178F0DC15B67D47
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.4190168737794
Encrypted:	false
SSDEEP:	12288:lRdwENKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:GEKiBLZ05jNTmJWExixM
MD5:	4527F57ED683F9DD9CA30B3C7D9355E0
SHA1:	85B0CE781C91FDE5F6988AAC2DE19B412B785DD3
SHA-256:	4C5B7FC243DC4F9CE8944EE251960129175CDC0D1C9112A67490B67EA53B23C5
SHA-512:	A151489D61ECC3A4EB267D4964611D9D9BB0042376C90A7CC9D3FD6A7EB23C38EAC467BEFD8E55500BBEB2F62ECAD783324D440C2B0F45D55D06933376E82399
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	163456
Entropy (8bit):	6.177989244157592
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYm446dewltB2mNd/HOrveW1dexk834fRZ5Nyc:WSnRum446d7T/H4X
MD5:	05EA4F7992353FD49C49A306F8A45EDF
SHA1:	7B11715A9DFA593DB5CB6BF7A88A992A9A3EE575
SHA-256:	132FE733C02E095F377C0971B9C7725C4B81EE5D8B763FBE558465641C382E9D
SHA-512:	D85C23C29A9745CB236FF9615FA57B0F3CEB0B1889B0DAFEA9FC6317CB07F8D5BF4EE977F0A017EBF2A2AFA5DA9CE25F2059F24BCFAA8401771C1C6A36D0E4F1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	127104
Entropy (8bit):	5.905773406209362
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmlds8nBs5s8nBskEsz2zy77hPxIAbBsnzA3QDkrDW8Kq5ns8nBsb:/OSn2M4MBYwUkEsqzy7pxI8BszFJqkb
MD5:	E7A1DE8F243343F1539D3C683B6FB4FC
SHA1:	669952C1316D0208E9DEE528D2A48F652174D5A1
SHA-256:	2725975151D4D1FCB987DCCBE77B6BECF28B20AF40D13817631DDCF9567D021F
SHA-512:	A0A1361C5720311982BB25CA56120EBCE030B1016AEF3D44690E4C18F9643E059B2ABD017F693E418D10B694682E6C9F9CFA5853F3ECF79ABA9B42415583D28C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223360
Entropy (8bit):	6.02812620662887
Encrypted:	false
SSDEEP:	6144:WSnRuuSyMZOy406qS2AroAxnw6f9JCXN1:lRudD5aqS2AroADDCXN1
MD5:	66A3BEFED826DD8AAFE2E1AEB34A2F47
SHA1:	CE9D17D982394152C0B0396905C341A800497D25
SHA-256:	56083031073805B2E656DC25165A891EDA52DBA0CB3109444874E0D08859CD1C
SHA-512:	686F1FE8AC5CC7E6953074D62D613075AE86C8847CEB6867C90571B22F7439956306C5ADFE0D23932E04115CD7CF4102C10B7392D12BE7F7B25352E3C2020ED7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.609153934610052
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBY6wl0hzyfN7T34oshWGrAUdaz2w9Lf0M/RHym:WSnRu3iFIf34hcUsz225/
MD5:	9EEAEA489A16A855CF07150397CEBD05
SHA1:	EF98FA5323A983A4D919A516F078434ADD1BB90F
SHA-256:	7DC7585791389FCC12C1619038EE0B7EB186DC59483A87C475DC4DB389123B5A
SHA-512:	F24BD8773E24256FD4F8996A1620183395F43B7E8E097E06D2DE2F4B478AED9ABE0ABF2435D3A9580F9CF1D8C7819ED76107C55366CFC46EBFDEC7C1AFA47BCF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.222842937733438
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:WSnRuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	BC45A3D3A118FE41EA2E39EF3A99AC4A
SHA1:	14452D4886909C14B32780035F8A78BC42EA6E11
SHA-256:	73D9101A39C5A9C932F06D113F9F6A67779D9DA2096C295BA5CC86BE070AD4E5
SHA-512:	31D0214444FD674E2FDAAAD32BC6EACE95E4535CF9CEAECFAF517785FE998CEA21E884BD4BA92165424D246C63D4552E14CE4D8FE5A1EFBD27065D863EA9AC5A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.222842937733438
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:WSnRuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	BC45A3D3A118FE41EA2E39EF3A99AC4A
SHA1:	14452D4886909C14B32780035F8A78BC42EA6E11
SHA-256:	73D9101A39C5A9C932F06D113F9F6A67779D9DA2096C295BA5CC86BE070AD4E5
SHA-512:	31D0214444FD674E2FDAAAD32BC6EACE95E4535CF9CEAECFAF517785FE998CEA21E884BD4BA92165424D246C63D4552E14CE4D8FE5A1EFBD27065D863EA9AC5A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	264144
Entropy (8bit):	5.744154270957996
Encrypted:	false
SSDEEP:	6144:WSnRu2PEC0QjWGNU6ITL1H0zvjkBA+7891:lRuZCMGNUbT8juo1
MD5:	D49F2A40B78E4BFC9D856F8429E6615B
SHA1:	AB6FE29B6EA50798C575D9A021E20D71D0EF5989
SHA-256:	988959E1F03988C2581213B1FECFED2C5F3C16CB02D3B552C1AB83E3346D9FE5
SHA-512:	70E438ADC33A07C2CA9179DB001BCF9B7E45BAB72367A725418A6FE7D1EBEF99774B3197CCB58813EB1589534946F392919E1BA41437320E80C41ED3631AF2F0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	430680
Entropy (8bit):	6.6033517305500045
Encrypted:	false
SSDEEP:	6144:WSnRuvmmt0fSoD7ZAOhPiURg/4KAaxZTTlvIfaUcuI4hWxBP9SGO0zyqEL:lRu+mt0LDdOUO42ZdocuI4kxBgGONqEL
MD5:	C1D7D2C7BA479BA02902BB608B36C0C3
SHA1:	3BE936E143A4D8FF8B91D9991027B6CB31A0B51D
SHA-256:	76A9CA52962CBA4F5370F6E74649BB9BF1CE838DB6E3FB9DFA8A643FF711B07E
SHA-512:	2C0AED14E6AF7040215E466278983C259685428F83AD7CF4EFD01D2DDDE8A42DA8D42B036B0496620ACCA62B660F144BE0AD42BE611AA02ED04D46FE584075FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.5699065121213245
Encrypted:	false
SSDEEP:	98304:OKkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:fkkCqaE68eV+0y8E6L1
MD5:	95AD11F27886369B96103876974CD3DC
SHA1:	1C43996D701767A2A80F69134C07E256391FB28E
SHA-256:	CDA1CB735F209EFB9B3B648FA72D62B23927690259E93E851AF87003C9D7BB7C
SHA-512:	BDFEEF68118EA4BDFEE171EF7C855961A64D8E1AB7C3F7351C9BE653CDE070C29E458BFC0AF146ADFFA87DFF4EE421A401C26BE051D80A9CE8CE9E2B9013BD2E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4316096
Entropy (8bit):	3.919446539073934
Encrypted:	false
SSDEEP:	98304:PlPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsQ:pNLniBPJhRELqS/rhb59SRZ5Vb9sybb9
MD5:	DC0425089AC683024B829010F40AE891
SHA1:	3D8DAF4D264562081956C3D476F7F9456B8D170B
SHA-256:	7BCA9E882BD6E255639D97EACAC02BDAD7B53C7613D44C99B3DD787BE24812D5
SHA-512:	BE16B54D9BA7A38AEA110B73F3814923091211E80D9521B350C58AA80E1875B494E70422A0EBE889F39463CB053ADE3B0F14E52F86BF4C36E4580AE2399C9B4A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94600
Entropy (8bit):	6.270025741980074
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmluELjOzHKd1XI/etzCJQx0cxnIO/IOmOe:/OSn2M4MBYuE/OTKXI/etG8ICILJ
MD5:	863355AFC5E89794A50564454A4C2C39
SHA1:	FCC5CE5B4D11A6C65230B6B8AB727297510DC8FA
SHA-256:	E13615D0A2A7D286C5706EFFAC59D00E6D7086CC6612850EB2043FB72669C4C0
SHA-512:	7B3DE854624B46DA2C21E5BD611E5FC395B4C7D80242AE3CD459A69777306BE23890F64AD21E46A682D8CDE5CAC69AA73E6E862F0DFC07429CAB9377D9766419
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	6.032726067611798
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmlcvpz3ktxGvpzvy5ZWGalHFmMTK0KRTS8bOzc:/OSn2M4MBYKToATzvmN0KRm8bOzc
MD5:	490EB31B16C46909D5AEE5B3DDF2EE26
SHA1:	98684B0D3BBBD67CEBE5F3C1135997F1F5263E5D
SHA-256:	6B62865CCA0DB7E27144E081AEAC347D8572608E6EC33F2EC31A564A048F0EB0
SHA-512:	177412ECE379099B63EE638BC4E02277A800BB23B56E71FFD7574FF88BDACF1E797B04F4D6156F853A432A6526EDDFB4DE6B7DFDA983D7C5A5782124150442F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	455760
Entropy (8bit):	5.925403423920764
Encrypted:	false
SSDEEP:	6144:WSnRu1wACThwS0vn9IdRsLGEJTdPA6lDfZNAGVx:lRu1wACThwSSn2dRANtlF3j
MD5:	20B39F7DDA182DC8A32DAAE3849662B7
SHA1:	269DF37AD49EE777619F283060C94CD61ED8086E
SHA-256:	052475A10BB12593755CFF436EC4BB5FF0F7B113AFF8C4E88163755A93EA4C70
SHA-512:	812630090366A8C2474F03340127BCDDABAA350DB3391E0D16326812EF4754C5DBA6D21D7C0586E077B655DA816654999FFDACA6C48248E8149E043CCBFA8FAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225704
Entropy (8bit):	6.20980291615692
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYNLqB8edYkIrv6TXRw9xwqazULDjkAJZo0RAjUIqXfkRC:WSnRuRjilq8OPwRzso6AQ5yC
MD5:	F50006D5E0F1909ACBA7D80E94A5797D
SHA1:	A38512F2E989173FD4F742A9F8211F5D3FF95C50
SHA-256:	56C8139505F400F9BA097C927CB6D6929890996F8FB8CFB729B8A00E319C8554
SHA-512:	E369FB19C0D6ACFB8D40BB91CF028468B24849A37E1CFB8077F03C7A72B253178309FA3E3F8A94918BD7D8A28D3ACD4FF94138AD26F515144BA6CD2E63AAFF11
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	84928
Entropy (8bit):	6.054034440048206
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmlh67wZClMML07MiapFmPRHyzMwzobtM+zf:/OSn2M4MBYh67wZClMMQ7MiawHyzMwsL
MD5:	F6886561A315379AFBCC7D6ED4E86961
SHA1:	365A3365E8130742152E87EA82693671138B1A29
SHA-256:	1C5FA677E8C0277E379740981854F0A9A6982569EB2E453CE07FA0B4008FE120
SHA-512:	02B6C157011F12A73FD9B9A31577F7DF51B817535A38DC7047DCB7203AA6AF0E19BC277E724EB83DC51E8275879B2033145E82A7446A70A1D878BED869696BF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	83816
Entropy (8bit):	6.103408821912236
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBml+0s7wZClMML072apFmPcnGzLHyxz5pOEtmwxz5E:/OSn2M4MBY+t7wZClMMQ72ahnGzextQN
MD5:	5709F5F490E43F34334162C517175221
SHA1:	C6278D4F2D8F066D61F425B9FC2993CF1B433EE8
SHA-256:	4952C998492531910DFF0E79D507A1E86B4BD2A9AA167F85760A80B4D3BC1A2E
SHA-512:	B03643160BF2EFD0805FD3C57ECAD300494C669D194918555D65758A4BAAAF5D7295758769B1937CC4FFE91D1F1155AD744D655BCAC88B64F1CBAFFCBAEA266C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	233832
Entropy (8bit):	6.270059176601636
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBhbW32GhNvMQ/58sl2U2Gszlz4SNBZCgMWku:WSnRvI2GhN0lsdspzPgg1
MD5:	E83FEF046B3B20CDA83DF49F0A833F79
SHA1:	A5D862131B9EBAA0F3DC14E7C4FF9E18A4182DFA
SHA-256:	3D17460E528F4C9C3AD697FB31ACAEC2015196A8984C2E47EE0D1A2CED5FEFE4
SHA-512:	3087E0787DABF6CE7A8CAB1C6E8E597EB1DBDFE3FB49E05711801C450DAD23344DF9B95A3E0F31DE4C75CB437CA6092D71F58B66F5FE723FACB090F4DF57D82A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	502632
Entropy (8bit):	6.64308733474167
Encrypted:	false
SSDEEP:	6144:WSnRW2WDxGH79J2VX5gEpvm7JA8I6BHAlSpFG/+Ls3ze30xB7zq2zs:lRWRMxCvm7JK6JAB/6N30xpI
MD5:	54F753D474B9057C1EAFD4B4459BF3D9
SHA1:	17B22ED480DCA4CAFDC4AEFB6CD0D53243F944C5
SHA-256:	3694F01820759B5FE2D377358CCFCCB0FC62224662C92CA8F5514C96479CE45F
SHA-512:	EF1406195FEA82F3559514C75745ADD1B65524F8E27E00ED66F0DCA720587793A6B3ABC8F82A306D8738689DF116014408EFC656CD22DFFF976184C3F3522179
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	352704
Entropy (8bit):	6.376217082335296
Encrypted:	false
SSDEEP:	6144:WSnRpxEshacHeGXduZtZ9zHVcI3uv7FgR3FTzWQ/ZZyp1:lRpesHHrtuZtPvh3FuQ/jyp1
MD5:	77B3005CA150B35B61486D3098BA49E1
SHA1:	E1EDD78499EEB928096AC0CFE64CDE4265A26E91
SHA-256:	F5114724DCC6C9B0FCD334A46293374748355C204829E57611A32F5B87ED2F66
SHA-512:	8BCB5E176523DAB5FFEBEE542C64720D6C4253C4468A1FE9C0B1DF91892C5875FF641C82AA62EA1F13B290561998269BB96A1EFF2AAF78F7556C9B3E1597EEC2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4395184
Entropy (8bit):	5.938246478855334
Encrypted:	false
SSDEEP:	98304:g9Xuo5RMru45b5dZlAj0sqW7YDKMzVwgBWMTwLe7G:aR345NRAgsr7QH6h93
MD5:	B46847BA7FF78F80C60A717F0E2B204B
SHA1:	A48660A4F36099A8CF1B815BD72C323F8BB24D4F
SHA-256:	1ADF80F49DA12D196DBA260D4DA58F0D31EB956A0B60034062B09E6CFA1A6B0C
SHA-512:	6432205DD29B03C3EF743A38FD214CDF1776DB405667AF8C2CFDAFB8DD6633DB29FBD4F0EA651F25F144C92FDBAD52DF0FB5F17440AFA3E8511B87CFF1F65648
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	603928
Entropy (8bit):	6.530730242189598
Encrypted:	false
SSDEEP:	12288:lRuszKRgqBDxoiPCLXHLuk/Wg4Reh2mbeF+IGboJdx:OoKgMxoiPoXruPi/++IvJdx
MD5:	0EAE967307488899CC3832B31512D1BC
SHA1:	B66A173F3FEDEC311C6D8028133F0A23C18F5108
SHA-256:	832C451522425BB80A552D76BE34AE2257090846D14431FB0B8840ED05177CEB
SHA-512:	6701C6933066EB8F7414BB500DD1BF36A625666C6B09554BD40A381F8E0CE6BC2CD2793685A3384B47835AB40CF0DD35A5090E7326F663895F1EE82EB8AF6381
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	507024
Entropy (8bit):	6.121657816494438
Encrypted:	false
SSDEEP:	6144:WSnRu3yrmBq0RYSv3A5DhW15yChMFt2XTNJWLgCWzzYhPRt+:lRuCrmBjYuALWJMn2XTmL7hPH+
MD5:	655B2C380A19EE642FEF2A9771CA6346
SHA1:	55DCAC9F7B6CFC309123E22506260F732CE4E090
SHA-256:	BB63DD0BF2B96CDB0A2663CE963EEAEB0F5FBC04E32187C52929B1F1A0A84C05
SHA-512:	12F8CBDE96C4599BD5019F6E5945B669EEC2A275D2315A330C753A46CFFD7B16AABE8B78786DB180B95902542FB9D7237F26C4CA59C347CED00EE373C897E558
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	251560
Entropy (8bit):	6.58934821913943
Encrypted:	false
SSDEEP:	6144:WSnRuDomAAOwPcPIqk4Vsvt0uews+qZP9zOPBxGiryKI:lRuDsAETlVsKzZPixGBKI
MD5:	35349255A5C6A4E838C75909BE169178
SHA1:	270731003194875E694FD0AA8AF36552C47576FB
SHA-256:	0939DF26BDE3B4D4209DEBA0BB749D566E3DB0307DF595B3B6721BC7114328DA
SHA-512:	5F529CF32EA38429F3D7CB9A207D06E29B26FEE24FABFBA53EBE26423CE273481AC8E17D355BA7BDBB776AFFBF7209F7FD110060AD7617372BFC43111A6EEBEE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	751720
Entropy (8bit):	6.644473589119039
Encrypted:	false
SSDEEP:	12288:lR4idI8PdgELg6eaBlnjlZcTerWv+xdeFhvCs9TukINOW:Yia8PWELTBlZ+erw+xdeFUsUkEh
MD5:	1E6B231DA296338D6EF1593D04AD9BB9
SHA1:	E77D7B9FA6FE6A1C10335AAA02D908833FB23565
SHA-256:	2AFD82E503FB1871DDFB09BB983FBB6E4DDFB3893C6BD82307B5B2B0A0DBA2CD
SHA-512:	3CCD342BA12B754360835CCF2B3FAD8DBCE2E25D40FA55F2D4AB9B7E6541A84EE253F87CB58C74299468509461850D0CF5CF893C117551C2DC93268B4E0ECC9F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161968
Entropy (8bit):	6.462919333873057
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBdNDS5lSrmjITI1FeBT77NDS5lS3j+Wzy6oUSA7hZ:WSnRvNDS5lSrsFeBTfNDS5lS7zUrsZ
MD5:	7BA650AE44D202C7AE07A67B4EBB6663
SHA1:	CB16195D10709D84422DEC201BBCCDE73E6173F9
SHA-256:	100CE1C8468ED77777A978EE60CCD7B3F1685D4B8E0D3F26A7AA8C4AA7D18513
SHA-512:	D96BE29F8491554CCA5929433617ADB61C5ED85F0FC0FF678756506A2C3721B6E692421B77F7726194DDA35BADC0A3FDE9380165E2406B9C9738DF72D1202767
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	159560
Entropy (8bit):	6.519360079515248
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB+QklWPsom9TiWWWWWWWQM+FtWAzhIwaeENinkf8xw3xUFv2tGPrtPmF:WSnREib5zPaNQnBxw34Oita
MD5:	ACB5318EB90B8560C37CC6B044399CDB
SHA1:	8F83C18076A688D5271AF39EB0E05A24F53F414C
SHA-256:	21C107C84257AB9060C005D2FD50F0AFE740ABACBBCE2332E10D8E6D3C9D3F86
SHA-512:	89251AEE430C4BBFA4284293CF196C65DFF391C5AE297A5B2A06F09C1F3C36C4C1EE3430BD4C0C271E3FCDE565E408EA8BE53AFF1284CF2D36A4A7422ADAFCAD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2233240
Entropy (8bit):	6.299281952949062
Encrypted:	false
SSDEEP:	24576:dvDZgOA74U4o//sbtwvZTqFDk9sg71SmY90gh/G7QJoma+9duNGeVG29H:drqHVhTr5UmY90sGE5dIDG29H
MD5:	9C1CF6ACA6CCD2477770422DAECBCB89
SHA1:	6504BB6086A18CB372326FE7BF44181E60AD3F55
SHA-256:	1F7A4E375A3D09A4FB2002FD5CB414CBBA88A0B1ED6A31A2765B03FAD222B418
SHA-512:	A4D6274569691F589B5A727CFB3CF2D34C2AB130FFB03DAE068A8F4103B7495273E2EEA85CBC5D58CC1EE28FB2878A922737B1D7A8A57E0C3439E3C3A19BF161
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214432
Entropy (8bit):	5.945566557907747
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBr3VFptXofXXXXXXuh9gLzltw6Q1hqOJHrtTh:WSnR9NtXofXXXXXXASLzb9uhqK
MD5:	ADFBCA68672F57DA14433C41ECE7DB95
SHA1:	30D101A47D3B9ADA7C541A3245E44F198756BB51
SHA-256:	4190CEB80BB37FAEFD2E6BC9CB0D478EEFB047BAD086D59A65AF922B6A0CFDAE
SHA-512:	303AE48EDB19B63D3543BF556BB4A583B19FE75F1EFF16AEA19E9ED426F4EA52D827558BD61F0CBDC04EBC22D671A25593B0FA004C1DC4129A0AE37A8E2D4BF4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	620840
Entropy (8bit):	6.599370789337404
Encrypted:	false
SSDEEP:	12288:lRD8oBdI/BUQtsfBCegl2eccL1q/xRyye7BfcwqEhDe:j8oM/BB0Bml2m1q/xRPCcwFC
MD5:	7C6CAE045607AEA8F6E3B19969766A50
SHA1:	7832FE62EC40FD1AE4B5B7D6E6F9BEDF1ACCA9CA
SHA-256:	0F014C4CBF87D203C8AF53624A4B7CC7DF671F052FAAE0EEF1B5C3915F58C10C
SHA-512:	41D674CDACAD08DEF0EDB7D6426B338C014CE05B2716E6BA4BE831A4D642240F6C97A230A88AFDE647C49E8C06C39CB1F76AA348C20F4AE6159B457C6068E4F1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1568248
Entropy (8bit):	5.675533654287086
Encrypted:	false
SSDEEP:	12288:lRhawF+k53zCG2tIuQ6DtJQSZDhLOhkZzV5i9w/lmd+jrcUiACW:BPFXG6uQ6D9L2uV50AlmsjYUiAB
MD5:	F03A8E1D453DB472C96D57F9E4C4A834
SHA1:	FB43E27392EE94E919A079FA819CA55BF48AEE73
SHA-256:	03AC8CB0359DEDBED9FB45ABA588BBCDB476375D71659F3833352248A2CEA1EC
SHA-512:	014E26EBFBAE9912189FA1266EF176232E8417E1BA7A97A2E27A340FA4C784BADE53032381101D2C0418A742DDEC84BDC47E524C693299382F97E2ED9111BF47
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	634800
Entropy (8bit):	6.716006938206051
Encrypted:	false
SSDEEP:	12288:lRuif/4sOdw+RfEB6tuAlnWhGZco6ijmn5jFTSt7yCPUkazi7JThVoSZeR6aQTJ:OS/4Vdw+Ra6V6g2kazidN6SoEVF
MD5:	10E04B9B3734905704E0CC6DCD251A21
SHA1:	E6F959661B69C760A906417695B99F2BB5F949A9
SHA-256:	080340D0B391BFDB988E96D1A4D13F8D7FA39862EF2E14E35816F43047CA7878
SHA-512:	37EC0AAD9F3FA6364DFDA393B60C720A12007F2D16EA41FB69A9B77212951980493B2EE2F04903988919B58E060120F9B1237D8E7B0D888D4D0DE78A9C654278
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	748192
Entropy (8bit):	6.718092163339896
Encrypted:	false
SSDEEP:	12288:lRuFKxLM1deLycUTc1kZi7zb1QRHhhj7WGvF5PYcdTFtZ3G97aSDGGHrbTwqFwyO:OFyY14evTc1kZi7zb1KHL8vbTlwOBC
MD5:	C91EF0CB7E148DB693A812B2A91BE952
SHA1:	3F3BB11DAA47F77AEDAD6A03994DDD3A02B28FAB
SHA-256:	C4472AACB649A8D080CF0BDE5EFB1B56D7312DF6AE2CBC73B0E4C7FC29641E5A
SHA-512:	3DEEE4F42D34669BBD24FC8F8874A80068398E5264937E7AF3712402409242CB273B566BC8BC0D98EE8F94935942F17FE408A23E08E355518D24B649F628FF5D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1917048
Entropy (8bit):	3.830426306557441
Encrypted:	false
SSDEEP:	6144:WSnRoeBeXsm81c57ZXFzY5Ucyw4TapP25xxlq4cUcMeTOMzwMwZ:lRo0Ks78A5UcyOPexxPcUcMeyvZ
MD5:	0BABCC186A189A43FA074CFAC4B860A1
SHA1:	C5D5721660A2BCBF1BDF64B64D7B4EAE6C34218E
SHA-256:	3750DFD6247DDF5835E9FD683E8CFB215213073B6F914D3D56E084B6AC2A0355
SHA-512:	36D6CD184BEA38EF21F401BC63D28D5B40430A730DC4DBAE51A18CAE444E07C974E5E89FF628A2480C5A4FF93BF5807A05C8B7C0FB43BCAE2CEC0F5CECAD209C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4099520
Entropy (8bit):	3.7137215089397118
Encrypted:	false
SSDEEP:	12288:lRouyKs7cvZIFpCYVIUN2mGsb8HtkLaHLH04cLbUBRjLmP29DyZbT9oc/m06aCzU:IuyKsY+dy0ZScIBqBT11S0
MD5:	D360DDE5544418AC1F276485BBF6476F
SHA1:	CFBBA1DD7CF7F6A2F2A441334467DC7583CB32CF
SHA-256:	451E488B26E6E5527AD673A8573DCFDCEFD881E9C1B730A25DDAF8AF8C74F66C
SHA-512:	85596A520EE81FCD1D6C336B51310EE1728977AB0640F6A43760FB266A1680CB56C2D54A3B475CA19188DFA568982F774411B80137353FE2BAC7E4D0BD7EEC1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	452120
Entropy (8bit):	6.032781415269367
Encrypted:	false
SSDEEP:	6144:WSnRu7vhCpFviM0OKAOVf3m+2fCz29fx8/eAeTu:lRujEpFVKj3mFn9q
MD5:	7439F9912867F89D7F97F2D8BB72C1BC
SHA1:	0EFAE573A827F5F4B980DB1D02E0C82AE61C0536
SHA-256:	C803D284D6530F51BC101D973115EF4A561A4285F113BB81EA9B11AF06402870
SHA-512:	195A9CDC8F3DA48E2C90BD527E162C20EF6CF13D7430A77122B45E8C0B6B2824A05E9527B2BEFC20DDEA84C4BFE49CBAF8B0FF4B058B4F6D983CFD6BA829DF97
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	116664
Entropy (8bit):	6.46796292950827
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB3IuGaz7jFQ68ICP5q0WISDr34W+wst:WSnRpIRazrA5q0WISDrZS
MD5:	A48D00F454C5E95B3B5C0B955D9781A0
SHA1:	C5F019E8A58E541E205BC80EC30864A48D096E07
SHA-256:	8FD2F34176C8164FBFA4A05AA6D85C9344EA6FA47EA181768BC29FD0D88E14B3
SHA-512:	3D3120BB48402B14E4740574D7C5317167F5DBF795546C4E5DAEE7461EABACA244DFB64946EECBEC2AC55E1187878FF4BCFFB9B444E39B391BE868773EA0EA95
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	167392
Entropy (8bit):	6.490611651353626
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYcWKZbTKeR3Tzp+8IxR8jYYrjHaVLIPSL1CgNX:WSnRucWK11Rp+8II5SLUgp
MD5:	0DBB3921E95B30FDBE68879E3D72EEDE
SHA1:	1AE0DBACDE8CB405716E4705660F0948B2789858
SHA-256:	065658556458B1009C65431A7A1DE7BD6AD6FA3CFC2FEB40552A5AB58A2351A2
SHA-512:	F092A548BBFB6F9239AF0E48159945AC0564A22EDEF787B18DF82A54E739B00D42174AC1E9C3964A58CD2FF157AC7BC3E833808EB0A69EEC8ED13758E6A6C82D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	670928
Entropy (8bit):	6.020369489017658
Encrypted:	false
SSDEEP:	12288:lRb8wbRB+ZRhFfGNpzX5PtiPWRnTLtx5eq4/RnYRoS2Ds+2EYR1XLlShtg7ksyS+:78wbT+ZR3fGrzX5PtiPWRnTLtx5eq4/D
MD5:	8B901160E7484067A2BF51F1F32693EA
SHA1:	02EC5946AF3DE100342381D80A9D512181F141A6
SHA-256:	D01592C4838C2E9F706B0211AD1C51DAF7263A470A4F3FF662342838DFF290FF
SHA-512:	C15988EE6D84ED32D297D94F2F17515AC92EF0EDC3D0B68EB7D3E1C0DBEBA4E3D079ED6F03A63E79BDCE6CD748C620F925A2A645FDCE7AADEF4F3FF0CECD576A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	115920
Entropy (8bit):	6.0705461521787
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmuw6pK75Rp1Ukkz2zct/rzdaBotnMuvWM6TUaE:/OSn2M4MBZw6pK1Fiz2ir+o5vWM6TUaE
MD5:	FAC21BFA6A61497B3B0FA04FC0F5E0E7
SHA1:	183368C88FFB2FBB6D5E74FC3131035636106CA1
SHA-256:	1A3F155A73C58C4A699B15B9BC30C96499754872F5AACA7A6F4FB36398E86DA8
SHA-512:	297667E2308E9F61B9DBCB4528189D4EC07CBA600BD719A789FFCB0E8298FB67A5382D06C5BCC38FA0910B95EFD97DCDB0CC8927BDA5901F5043E050D8479F9F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	137776
Entropy (8bit):	6.427303029926732
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBml1LS+I1HtQdiHN4zbyezltnzGd1XuDxhkrTJwNZ5wmW1aHbfC:/OSn2M4MBY2Mi+zWeXdswvqiHm
MD5:	01CD893908DDACBE7B624F20271E6BEB
SHA1:	35D4DFC976A21DDB4B7EAA4B0AFB02AC2BC6DD45
SHA-256:	21FC91FAF26ECA83C68DFF711972DD072D3B2A5A5F069D24D7D233A82CDC7C62
SHA-512:	816F590F44C9CDF794BEF34E0BD76BA9E2AFD054EB2816586EEAA2DAE728CC2EC3C65A74FFA402F0701947BA342070A8475C0DBEBD78B5BF3380E6DA9D841AD1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1206680
Entropy (8bit):	4.877908195897831
Encrypted:	false
SSDEEP:	12288:lRLG61ZFViRpx5tuwZl4asd/arEISgX0IkEMhTy:rG61jViRTfVINdCr6gX0hEl
MD5:	D01487FCCF35AFE6612EC198CA6BEADF
SHA1:	21CC074B999A1C03D976967AE5F64A0AF2A2E39C
SHA-256:	A98540C078D27D015C1A4EA0BF736F4F6E69E716CE214BCCB73D035C1D306AA3
SHA-512:	E1870DFFBF41C45D7A33805FAA398F0278ECB3D5C9BA96165EB0F05816B99E78737D3E4C411E7D13110DFA4568BF6A4BB393DEF3A93D8073808C8F858991B251
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	400336
Entropy (8bit):	6.665431317592719
Encrypted:	false
SSDEEP:	12288:lRul1rOCPapfd5bhooUBuFiExw/LXa20Dj6EzfJ:O7rfIbbhooUBu3wzXa/Dj64
MD5:	0E396A9D9DA735A0C07D2A3E7BCA53AB
SHA1:	EA5C6BE5B7822365E9F62423067D31A26996879A
SHA-256:	F4E701AB0C66157E0817F4683BDB8B864B7AC6AA6D696A4E403CD0EBD3D61B3B
SHA-512:	4A96C2AF3DCB3087DF4428B0249062D9832BE6940127AF5F2D5C66912E6D125AC918B79299F43750D21B64F9B333B20EAB6EFAC316E39245756D0C2D8316515A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1662344
Entropy (8bit):	4.271965903697506
Encrypted:	false
SSDEEP:	6144:WSnRgbztkAzkAZqrEdrEAZUCwFjNNYEzcL:lRgdNPqrEdrEAp
MD5:	E8DA16933B97CE97A8E103C96DBA9A1A
SHA1:	A51FC3C5A7F6E7B0E5637BD3A05215531B0614E1
SHA-256:	5914CE0EFB9D7586513762D70EE6E05EF053D5765A61140A4BD519092038A99C
SHA-512:	0A21A1783E1EBAB38AECEA06D0EC8F73A78C7618DEDA6E63ED461D0979E614935479088B8619B28D277F2E24D05C5C5E3C2D5A99128784810B85968DC3F61C86
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7769087712372027
Encrypted:	false
SSDEEP:	6144:WSnRghgSRJQYKV++VYwjatvsDVpDsehRAKzYM:lRgVQYZTWbDj5
MD5:	05BEB932DA6F09A810E5634D8F908D2C
SHA1:	8F902E0E102420562AA0D6CCB914FB28AAC95561
SHA-256:	449B7C6D0F288785DC74FD07B4713A5F1A17A14B7A0DC85F26982339630E4B9C
SHA-512:	78C081261454402AF6C92F2340926A4B70A8E722693113E0C8022E0F68F0A616482B120484D31BE1F3CBD5D5E1121E185CB7225A470F5778C15EBC23A1236EC7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	83880
Entropy (8bit):	6.28064741837889
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmlSKfEBr3fHT4nAzHGkYJ+ziw6+zb:/OSn2M4MBYSPh3IAzHGEJn
MD5:	34BC56A99F289562D656B332C04A582B
SHA1:	99C6D6DF90D5682D49622DC228CC09DBC810FAA9
SHA-256:	620CE3452769D85B995E7CC20A385CAB0DF6CAEAB370C540ADD8F85B72A30632
SHA-512:	D376B72E55EF957DEC6AF3D9354CA06BFC4991FB8DD5E5C54A9A17A21130CD2C2BB48C3361235568FE79CB220569B7D7331291A1962D06C1B24E3944D520F430
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4319112
Entropy (8bit):	3.8102534907480923
Encrypted:	false
SSDEEP:	6144:WSnRABUh82lTMY/C3uuQyMyquNlBXYJ7M444IB:lRABkyIgG47B
MD5:	17703F9B0B2D052B72FE865928D7B339
SHA1:	5ECBF68900608574F14778A23B837196F05157A6
SHA-256:	CE1170BFB436FC88B53EB4268F73DB693C0BEA57F9D58147A4F6C306F6472D65
SHA-512:	E1BBEC6313880F9BFCD68F2941762A9C18E87ECE76043C0B61DDB14F5557127C891BAF8ABDAF98658ADD3E81F19C088777CC9978290C98F418A8D977C9AFD3D2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	785448
Entropy (8bit):	3.926548050556616
Encrypted:	false
SSDEEP:	6144:WSnRLAWSXeSC+hBMdNRneNMToeGYeneqjpGtBlmF:lRLALevUEcLe9l2
MD5:	E3443B32B1DCBF07D430FE7A27468E0E
SHA1:	6151A69C3C5B5E5353FBDC98F8079E966169E192
SHA-256:	DEAB5CA480BB592F2AB2F19D54A6BA49070FD9A4319C632059F21EA1FA473E9F
SHA-512:	57C1DDD9B1926BDE00FE6524FC137E88C611B503055B55A2DD24954085C0211A2EFD807A0589F45E68D0C95D76C20BAE981383E3937FAEC132048D0FEDC52D8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1081280
Entropy (8bit):	3.7583757025643227
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1ZyTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS12Zzwww6G:WSnRTZs4wqmQN59wtSS2zwmG
MD5:	7CD97CAF09BF7745DD2AB575B6FF3573
SHA1:	ECE49B229A8216850FE6969031F48F769A2E9757
SHA-256:	0669FB6B6FF001B6DEEF8BC7D86DC9BDEE749D62F7602D51D8D57A5F52C18906
SHA-512:	03DDC2502B44B6D64D67693CC20E7D9208011FDEECF9B1181BF7BCDD99657F2F68FCD502D3A410FD0DAA06E925FE2B070DCF2ACB561E76EBCB7553192957182A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1722808
Entropy (8bit):	6.4876506138568875
Encrypted:	false
SSDEEP:	49152:Oguoh1EWXRkd+h9y6NsRZ9MtL4kD5G5LVuhqITJemL9SQM3:OguohO2km9PNsRZ9MtL4ktG5LV93
MD5:	BE2A9294CA306280B3ED2E55034CB45C
SHA1:	3F49019EB53946C17836680697E37C32F949D937
SHA-256:	9E9B40E09B6B85F515881166670D428C99C9360CB3ADE49A2A85964907FCC00D
SHA-512:	D9C24585DE6426331913ADF9D235199C9FB020235DB270F7993D89F458197CD5BA61F093BB48D06161C611EB721A2750AD2AF7314AA4E2D481C17D2E806F5D3E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	307784
Entropy (8bit):	6.532571971096888
Encrypted:	false
SSDEEP:	6144:WSnRue+OpwoajoJ/cLr6eNI0A2kg79zge/ceeE1+v:lRueDWhS5g72veeU+v
MD5:	D33229AACF013F4ACC4FFFB94223DEB6
SHA1:	E5025B6E62D8863B645120F36DF3349089A6B170
SHA-256:	ABFEFC95E792AB7283D0DB06D198E39A8A0609340AF6ADD010B1F6A5AB1D3778
SHA-512:	3F1F5A1218FE5C4C6197AE86284AEA37A55DEF4238BCB499A94115610BA8CF796BF002B8F292AAC50785786B0199B62BA0E58AF16CA279C6E09537E322750CD9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	97920
Entropy (8bit):	6.235627291515181
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmGdzKAtCz72I/Q/RPTO5piDDFwzS:/OSn2M4MB/duFvgy5piDD6zS
MD5:	D3CD197F2F7D52CF317D06251531902C
SHA1:	C285D6DF5CD983E273A9C99BB8B1D65079ECF0D7
SHA-256:	0D104BEB40C33720700D83398BF04BA2F81AB8690E2735940DA95A61670EF601
SHA-512:	901F53B6BD006C6DBDF57F7B3E689844030DEC8568960B74B44A3EAA9979CB90CE8DD6E8E3DA72A08252D6FCC6CF563C27F473C804DB810BE249C813510104F4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1994448
Entropy (8bit):	6.55044109103448
Encrypted:	false
SSDEEP:	49152:Gsl8U9+tiqfG7C+5I6ZOX0Bh4MdDHc/EBRXXZUABfmcQ:Gsl8+++7hOXODHc/EdQ
MD5:	1F1500E4AB3E133F85CC2C950F502798
SHA1:	88EE18874E75EE9B77B728BF4DEC6C847E5912F3
SHA-256:	6D47459CB8C481175A4994BB9530A5BE9198A610751B6EDA9E3D1033F55567A8
SHA-512:	325D1FE7422832E8B9130A99D17584B948A724C6A8892ABD56B7F42935F3ADDA42A7D11E8FCBC09D15D7A041AE0A9C7A48649A14DA43A7D8E65F71F18CD17844
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275872
Entropy (8bit):	4.16031028355269
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBm8c6gJJRaCAd1uhNRu7z3zHt4s+zbCtbCc0xXNmi9RHYOqEWpVO/:/OSn2M4MBdc6gxe7z3OzY+9jTYbE+la
MD5:	B97AB59619DC9497C214477C7476ACEA
SHA1:	80C5098E2DE7C15E6940D6D2E911092F5D4EDB5A
SHA-256:	75BBDCA5942FCEEFF0A4E7A6AE16B466604DEFAF4C49A163A9E8E83C749FBD18
SHA-512:	E2B43F9EA28D322A90DBFE2D821962AEC6AEF2744CB036613BCAA09E67FB30C33B36003D9345AD98D5977931561D73AF9932F91F2AC8500AB2F3C7E155D1C97C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	751520
Entropy (8bit):	6.509521008226943
Encrypted:	false
SSDEEP:	12288:lRu0ccV8BFJ0kz4uP9V6wY2M48aVNfffNfYRweSat8UVNfffNfRtAUUn4lDW7f5a:O0OFJbl/6r2M48aVNfffNfWVNfffNfDP
MD5:	DBD90967EA8AEE59C92A0EBD81A1C102
SHA1:	CB52E89CF1C1BDBBEFA497FBAC0417A0B9F9E9D9
SHA-256:	E03CB33BF7246988D8D1B11D36F9D0DF3D2D47E8BCE195DA898F15C8755DA4EB
SHA-512:	A8C663A6F01F8AAF4A305350B82F50A3B9400C03C23928D7E1CA5D9547650FD9C2985AF22F063BA4ACA054CA4D24F0CD4C2089162766DAC336F579F78786046E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182712
Entropy (8bit):	6.234535637508048
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBY3DbGpEPwVH+lMCNy0GEVVS1ikLrDdevXqHai8MBEL4:WSnRu3XSSwVgvfkhvzHcWEM
MD5:	1CB1D84ECB3BED606AFD699C5D87BBE7
SHA1:	E57B4A0814CA3260B2216AEBCB11ED3CF62BD1BD
SHA-256:	778901298B871A257A6FE450BEB01E626549CDFDC758CA6AC76936385EB38B52
SHA-512:	3D712F97760DBF5AEE7085123BE3B4ECC9B34DFD503C84E3BB3250E1A39BBC00E2695B7F723F71E513220F57BDDC5659B7B6654E277F1E58F2BA1F94803AFC2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5174360
Entropy (8bit):	7.2635710452085664
Encrypted:	false
SSDEEP:	49152:Oq/xFnOvtaWIDn0apLKkLJU9nU2foKhA4vSWidGHp+NDGQUzbpDOfjxAkrQKl+RR:OstLK3BDhtvS0Hpe4zbpaAKQkroGIz
MD5:	F5F2334A2860E7FC3285A7B1862523F2
SHA1:	85AB9786CFE9A48B3C4205DDD669644E50CAAE99
SHA-256:	9C528AB23BC15812E52E5EC3C71E27F98EEB7C11598EFF83E21B5E5817A50CB8
SHA-512:	49E84D80A93E3DF10F779AC6BB9196D1ACBCADF1BABFF5327714116034D07852F66707CCB709A0B6E71C75E6DF05400E72F8450A58D03B74DF138A4431B8C021
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139712
Entropy (8bit):	6.445785821108962
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYGU5adWAKmzUccnzkVBgEuKjj0WWtPPoI:WSnRut+EjzCg+j6P3
MD5:	94E75077058817B0C5FF3141BFE2F6B8
SHA1:	72EB17380790BB943C36D710291E445AE3D4BD02
SHA-256:	9BD7A7B66E04514C019D17BE3744AAAD60D704041F2AA006759B54776774E19F
SHA-512:	7565A69F4DE8B87A791F9D86436694E22976DC7E2B81EF40A9720B7DFD13C700794BE1EDDC99DEC425CF1DF21CEAB030761C790940F7AB5B6B8009349BF5EF79
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380368
Entropy (8bit):	6.6814444423488
Encrypted:	false
SSDEEP:	6144:WSnRulzgSb/029S2P/7nzGxFrRN0r0ivCZci1FXiO8DaS4wwE0CBlFJmcx:lRuqw/2q/roN7ivCZci1FC74wdBlFYU
MD5:	A92EC0CBA11FED02609EBD2D54E552DE
SHA1:	C697A8E9E58FFD342C1C1928FBF8107EDA5925B3
SHA-256:	1C302A9A0C6CEFD88935F147D12E71EF8538A3E98D8C72BB7E8633BEBDB521AF
SHA-512:	AA605B58E758DF187612EE9BDA1DE83B104D759EA690671B7BCE43990069CC665DC8536C2938AC5873782FC7ABACB24E234CCDD47AEEC861FF78E4EAB45CD61F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1269696
Entropy (8bit):	3.731614804405323
Encrypted:	false
SSDEEP:	6144:WSnRTUvk8/0NhFYAddenZhUhTNnLUrh+9nTGLljX4wuSzVF:lRTY4wXF
MD5:	C489207E0EF41320709D37F03F3E785E
SHA1:	7CAEF78AA0D06A67397FDA1EAD48C2FEAF45FFB8
SHA-256:	CC73407D2A1C0DDB5826692E019AB7C6EA0685807F52126AFAF616F3F8C265B9
SHA-512:	E19F6A3B1706637254DA702170FE3FAA7F568FCBE41E8FE6233C22EA8109E9E52B28D2496ACD3EF0AD8560215614ACFDDC7E5D822B1B7F55C864CB69390F2800
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	4.115998887415334
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBdDezzvhF1h3wEWwwbx6ksl4D:WSnRvOzvf1qEr2slU
MD5:	BF6AF9140B617B232D9678780D152907
SHA1:	181CD0A6F7D7762025F9F486702FC4D487F08A2A
SHA-256:	82D22EE3D77D9B7DFA5F0EEDD116FE1182377060CC6493545D35E512EA6E0CBB
SHA-512:	B9234DCB26D6EC832945E2D2A0CACAE99ABAC860F985887D38457D0B683ADC4A9918C4B51237973D894A9131E7215C4A1DA442CFEA68D2A7F2CD13BCBF9D16B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	715760
Entropy (8bit):	6.521923206340252
Encrypted:	false
SSDEEP:	12288:lRuz4tuuLntIMDXw5vde5EFf1Pmbd3lSz3dfp1Swf5M0blmFKuJOJZM30j3:OctFDKMg4iX3djfy0blmFlme303
MD5:	5AD9ADBC00628834249C9B9DB1009047
SHA1:	592934A27E72F601974770707C8BB9F288117E05
SHA-256:	7AFE90B82AA1DECEB32D4792096A3A1FCBBE53ADC3A48CED1F36783A29CC6ABA
SHA-512:	C94FB17E5B8D441C84F929973AAF51DB814503C2AF281972237E3E976161CA905E612D1B8158CCB2B828891FB1A85E304EC842E22DC2FBF824F81FD49E39141C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	619944
Entropy (8bit):	6.633947276257484
Encrypted:	false
SSDEEP:	12288:lRuQM/Of/Bboj+clWnIKgrP6TFPLNWuX4Pemn3oi8ky9Q8WSe/aSqizuO1qukdQR:OB8JgryFPLNWuX40RulAPn1OcnGVNff9
MD5:	06F1BE4383E6F4567CA9A68D57E9D1BD
SHA1:	19537952FD116F93EE40E5C18475B4E188AE3B4F
SHA-256:	95F7D994D5B4BB3AB3932F7A88FE94771912E89B95E42541351452C1D0740D54
SHA-512:	81B0738AE1CC41A2E254652770A9AAFD39BE03B6CD24CBF38BFB86A348C0575C89181B4BA1C652A59ABAE4D47B286DF49D354AD567EF945C9AFF569BBD46FB1A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	150416
Entropy (8bit):	6.410709036144061
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYsQPtLW7twRxI5mc5TNN3AsdVgNwihwT3RqEM6ZOfHXb42:WSnRusQMzhdV0nh4Hof7
MD5:	692F4688BB7EC9A0B30362DB7F02DB5C
SHA1:	1724FDEA66D1EAA50D852A31C96A984AE5197BF3
SHA-256:	D8265EA39086A2D23F60C4A2EB396DE85D127EC6E263E2BAF35A40C044A9D3A7
SHA-512:	6E38DC631B9B35293F5A3AD60549E164C30E1C240FEE46778CDB30ABFB995A7235E6CB40BA2B9B8656766CB1A74384AE8AECD591DBB8D8A009BDF5E8B823531A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source user\OSE.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	264576
Entropy (8bit):	6.632817442844841
Encrypted:	false
SSDEEP:	6144:WSnRug872jsLuLnPo2TTHswP2TGz3FUCHySYI:lRug+2jsLuT3MfTGW5I
MD5:	438EAC2B2ECFEDFAA41C7F6E7695BEBC
SHA1:	07A69CBE9CBB50ADCF37AD20DBD1AC5A722BA409
SHA-256:	3533B461FD439AB5433555A5D8A20959F58C1E5FCBEA7E86412777D7E70C4A12
SHA-512:	57751A884BE8A54EBA5BA57BD7BEBADA15B4C3389B15F063581BEB87B71F13E732296C95EC2DA845991C3167A04C18FB910476FBC6D4B4E45760AD52CE485328
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	5.82323399948206
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmlWweqz1lezmtJwzojsKyyJFGgHZ//rHzb:/OSn2M4MBYSqzXe0wSyyJFD//Hb
MD5:	F22F545E861A917FE35A1E6F6AD29224
SHA1:	0642A39103A3E9259493CEB6780BDCC53C44FB44
SHA-256:	E0F9A311C2FD3F7066AA7F7ADC49A69618F03517F112A70E31FA34EF6037E0B3
SHA-512:	E26D2417F57DB9CE117477F3F7A7B0B491F46E2CD8A157FDE5D2770D5634CD94720E6C6BE0B7A646D9D7143162356D910AA5AB90AB7CB6EC35CC3BD4223B1DD0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	662600
Entropy (8bit):	5.97313792897459
Encrypted:	false
SSDEEP:	12288:lRu+po/FEVciSJJtH4PoR6moWEBfQLxZPhEx7xgtV2hv4tkYUK2tlIqR7lmNK/It:OlFEWi4JtH4PoRfoFIxZPk0NKbB0R
MD5:	D1853EB15CE9F3397815815F36C00F74
SHA1:	23F7256405CCCBC1A01E600F63542B15FA33226B
SHA-256:	A701356922B92E6123BAF370DB1AC759B32C76EEB4A4D6500A85EA11B80A8384
SHA-512:	3519F06639DB2CE81832E929F1F1DF6A3B33F910CC02ECC06F5906FA61C1DD081CF51C14BA759A66DE896A9ED7E1506841DFDBC62332758817A83D12515ABC2A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	260560
Entropy (8bit):	5.363236240280007
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYl4ZAh7ULoQdHBjw8Q2pFj4+W1ISYpksZmRohnonRBfTjzJEthEWV:WSnRulPfQdhMuj4VM8imPjGthEWV
MD5:	C408A934F46A61D87C6D113DCE84D6F5
SHA1:	CFB5567F40E045CC61270FD0A7C975F425C5918B
SHA-256:	5EA7F7B66B2B3C84D2CE6A47BC038C2609936086C4CF24743EB3BBA6E143E92C
SHA-512:	D527015481808C57B5964D1509763AD44C18A0C67EC93BCCDCBC80CBCD91515CFCEBA75CD136FB8F3DA46B986959D25200E7FBAEDD8E5B8105A9B902DD0DEC25
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4316200
Entropy (8bit):	3.914329121543603
Encrypted:	false
SSDEEP:	98304:PhYN3nsBQ5ghvEyqf/whWovz9hRJ5RbisrbdsPO9jXsw:+N3nsBcghvEyqf/whxz9hRJ5Rbisrbdr
MD5:	1A793F11A8001ECA2F0136D47457879A
SHA1:	479E6CB9005BDA786556A3FFFEB20008F5BB5A8D
SHA-256:	136B8B254C8079F9C98F82F2C458EF64B4BC6108D3E8B8320228C6DD1F1ED618
SHA-512:	3E94B11D4634F3CA63B1D24783D373869569A22890D7B3A96AE58DA3DE90F2E7AF1D9182CF53780CB414067C27A3299177E6E032C803111389F5A654405345CE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.568186972649657
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmUFwu7mzj9zNtP9zNps8Q:/OSn2M4MBhFLmzj9P95psb
MD5:	E45F0CF93AC18598ACBC7ABFFC7CCA89
SHA1:	94DD76CB77A4D0816CDA9A326021E31BAE226C83
SHA-256:	BB70948C62D365FAB4D05C860B85D497E568D2C48ADC2F8F76532A7DF0E1A031
SHA-512:	925572DDBD66372CA8F19C3799A285C08C752137A56204B17E6D500188B3694F9287A32BFF8AD31184976337295E4934F15F6AB8B04685FC5E3C792E35E6A671
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	358336
Entropy (8bit):	4.453555678665042
Encrypted:	false
SSDEEP:	6144:WSnRqcyUkKOEEIK128d2VKjw0EYsfZJnPmTuJjac2a51lHpLszc/kzY56Y:lRqcx/B/kib
MD5:	495B579D8AF542C7A471607728F04F64
SHA1:	1CD2F9ABD21B974F594CF51CA0C7939DFFC842FC
SHA-256:	9B0FCA869BEA7BB7146F81BFD7D5851DCAB6BE0EC1BAE17D4B88881E6B6EE68A
SHA-512:	0D33BC9D4960E8BA9F5DC2AA1C8E174BA280CA1BAA3258D2A7FC112D92F4251ABA410B3B661DB2563E311E114EF19D7E00A1F7B12E167D929674829CDB1151C6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	763032
Entropy (8bit):	4.086339818910422
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBrlwRnjnzhCiXXXXXX1AzZwAazTwdOLxN1IHO:WSnR9lwRnj7XXXXXXSzuz8OZ
MD5:	22455A70AEEF724732B8CEB4931F9952
SHA1:	4640EF726463E688D0E6B50332287559F448F2AB
SHA-256:	E84016E383D73A36E5A8FC7B973961B8A5A6AE3F99AAFE188AE17C27E01362F4
SHA-512:	86507358C38EBE04982FC00DC5AB0EA0D63C4709483883A4D241ED561615729779E9B20671B2178597D6BA7673503B4872817B2ABD28313AF3558900EB32E6D8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	895120
Entropy (8bit):	2.949772162759741
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB9pfCEq7tOxIfMFzCEpAm/4rx7z1arf+9:WSnRLSz8w
MD5:	A96EA3A78535EBDF4CA15FBEE85EFCB8
SHA1:	81D101FE97CB0D2B545D332E8CC930248B0D7A14
SHA-256:	08A3FD822E612D640E1840F67ED103ACAADC926610725AD9D1E2B8F0A2F75771
SHA-512:	65667D9E128D3237266301841CC9E146CC891CB88ED157F106F685756E32DA86E28320EC8F2D90B83117171617E7ADCF63293483F478E27B25C4420F8F1A1371
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7544122152462154
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1To4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:WSnRTk243xmQm59UtUSfz3
MD5:	A90116D778858AF14B60F83DD27A7EFF
SHA1:	1191FECD91A386C54EA304672D229702823304C4
SHA-256:	33F9CB778DF0146167B6C71EF1877F54B8E1F73974941A63BAA083F364FF5EDD
SHA-512:	8E6E33DAB67788350037BE8CE7EAC2EFC768BC53573EB0288E700922DA03889D25EC464834D1BC1354DF221C9F7FE8BACE769B207C8F644A8E507C81E0BC7866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	105440
Entropy (8bit):	5.872182724788536
Encrypted:	false
SSDEEP:	768:/+9Fan98uZWdolxDuB22ttSHI0aBA7rtmq1YruR1jL9zxwKeL9zgt5tjTh7D9:/OdUn2aHIFMBmmTjhzxwKehzgt5t1D
MD5:	BBE17C482900048AB2C94B53C5792BCE
SHA1:	6630CF9779654D3E5998660ED33224F2C24DE1E8
SHA-256:	9A1A7E75D68157D602C599C3FC8916F5D3EDD1272092FDDF7B248B302F23FA40
SHA-512:	85277FDDE565D123803EE86F7A6DCDE5ACD6861C5FC4EFD037F05AEFDDFB4F6836AC9D78D758124BA74A442617FDBAF01C00B220CC99BFCC8B148D95435563F8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	537536
Entropy (8bit):	4.928102174522068
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBLKPMMRMMMmMMMvMMMwMMMNMMMWMMM3MMsewVOOMzMMvMMOMMMJMM2MN:WSnRJJwVR6V7byjUWAZyVVdz8eEdGo
MD5:	75A7F4678C5E6393C620CF8D45459FAD
SHA1:	C6301DEEB1CD1503FC2CE5752A30B9DC9E2CF507
SHA-256:	A5B441477F1E037D56E7B40588107027792881CF0DAF82E7D0B74A12380E5FC4
SHA-512:	541625D0A35C54173A4CE69270B65AD372A40BE2D35546A36B3886D88DF26D63C2A1618AEB241E1315F387FE659394EA1AC7B40A3855BB7FE3DEBB05DE4630DE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1271952
Entropy (8bit):	4.058661790267618
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBoP3ppPpNpDpspp/pCp0pmppdpspppRppMpLp0ppppbpQp2pphpSpXpi:WSnRW4KQSNdhnSzv
MD5:	38DF967953544C53576EB93DC9586A99
SHA1:	CEC8D5555CE7EC20A8E7D6C3CB4C09877CAF7665
SHA-256:	EB04CA77350EE3F0693B8889381F7377BE2AA9EEB79829D73853A641B50F9485
SHA-512:	AE9E7CB2DB40C1E6F6193479BE2782A9F197B4C65D6A3CE4796BAFEB0DA5DDB63C6F59034F5DA58C81D79F285001B83F82D32B7FB499895879BD6BF4679009D5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4099760
Entropy (8bit):	3.709958618186736
Encrypted:	false
SSDEEP:	12288:lRorBKs7fvZIFpCYVIVN2mGsb8HtVLaHw3j4cLbUBRjLFP29DyZbT9gb/m06aCzt:IrBKszX0FjOeblHiled/k
MD5:	CE261287BBD570184FB8F1424023D31B
SHA1:	FF8AE261072F5EF1500435B430A15DF84A2D6F5B
SHA-256:	A1B43C90763680C2636EBE377F0ADAC6B1C8D296CC3EA339DC5795F9B7B09F1F
SHA-512:	C4F4518B0C8100DAD9BC4F44224880258649910A01A882915923C6AEAC93E467C1EDEC98C929CAEF43BA3DA72484141234A3A23865FB8DC877F018C100DB4CEF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273488
Entropy (8bit):	4.2992851897352455
Encrypted:	false
SSDEEP:	3072:/OSn2M4MByT6bZt+ATS583ONo4aezJ8ZfqiA:WSnRYT6bZtazB
MD5:	29A0FD361DFB6E9181FD207908B0DC89
SHA1:	CF896A827823DF0AD3338A6091B8EE3BA84918A5
SHA-256:	F709FC55491CC8AB1613FDDB3FFE87902277598F2027DF4CB257BCEA24465C5A
SHA-512:	72F2A3AA87A662152261A79A47D5F7E01ABCEE84C72063797E4410CA27211A82A76ABDCF9FF650FC718F5B73D1FC050B1C96E819FD9C68EA27395101652C9651
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.568186972649657
Encrypted:	false
SSDEEP:	1536:/OdUn2aHIFMBmUFwu7mzj9zNtP9zNps8Q:/OSn2M4MBhFLmzj9P95psb
MD5:	E45F0CF93AC18598ACBC7ABFFC7CCA89
SHA1:	94DD76CB77A4D0816CDA9A326021E31BAE226C83
SHA-256:	BB70948C62D365FAB4D05C860B85D497E568D2C48ADC2F8F76532A7DF0E1A031
SHA-512:	925572DDBD66372CA8F19C3799A285C08C752137A56204B17E6D500188B3694F9287A32BFF8AD31184976337295E4934F15F6AB8B04685FC5E3C792E35E6A671
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2970664
Entropy (8bit):	3.8427337300667155
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBndd0qVmvzC1SvXKo3NzbsZ6DdIAZcbEcofUnpfRII8Lp9qgN3WJp0RT:WSnRFd/V/CfDhNG5sMXjjzmEPoL
MD5:	CC6F92FD442A8630633DA3557FB3A489
SHA1:	969F68F52FD8D0DB8559B1FB1B0DE11ADBE77033
SHA-256:	A29649237F2E7B62500B4FC7F26106494171214112C31876CFB8E056E996D81B
SHA-512:	3ECF71E4616387B1B95672E40F29207AB957124917A5FC262C881332B530B2084401EB0F5FD172F1BA9C5A1082A1BB71DE552828C07ADB1142A9F46EA53CFB45
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.772604524405694
Encrypted:	false
SSDEEP:	6144:WSnRgOsSR7PYKzz38YwZItvsDu7DbDhRAUzHW:lRgiPYmLWSDBy
MD5:	5052E33A70E8CB76845A53A361319AB0
SHA1:	8783789BB488DA6DD0C2409033CA439431A858CE
SHA-256:	E1673CB2331D273DEE6BFA1AD1919DE213E0D2F61DEF24AB1EF94A8587D12925
SHA-512:	1AB064D7F17D05A8E5C0BEA7BE27749F1276ABACED66BD90DD84474F006FAC303F2DEE2DEEF5720F9D949DA32A531D2CCFA1F2181763FE4C4743275665BC5F87
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4319272
Entropy (8bit):	3.8061516971995557
Encrypted:	false
SSDEEP:	6144:WSnRAWmRfvlTZY/C3ul0ywb/uXMo+YJ7M41zXLWIB:lRAW+6M+595B
MD5:	4CD050C053FE445E91F3C9124D20166D
SHA1:	564E7AA6CBB914490A487AE3E5D144519A7E7B6D
SHA-256:	39EC49BA79F7A9CFDD0B507126B90A2CD004DAAA1DEE39D08454B4BBC1B31CB7
SHA-512:	D49D6948EC791EB7F4478BAF589D76659AC07800DAB5162989837CC85523096BF1957857C80CD1436419F89FA590C0DA5F58B039E851CA3C719D3D910FFF2482
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7544122152462154
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1To4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:WSnRTk243xmQm59UtUSfz3
MD5:	A90116D778858AF14B60F83DD27A7EFF
SHA1:	1191FECD91A386C54EA304672D229702823304C4
SHA-256:	33F9CB778DF0146167B6C71EF1877F54B8E1F73974941A63BAA083F364FF5EDD
SHA-512:	8E6E33DAB67788350037BE8CE7EAC2EFC768BC53573EB0288E700922DA03889D25EC464834D1BC1354DF221C9F7FE8BACE769B207C8F644A8E507C81E0BC7866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7544122152462154
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1To4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:WSnRTk243xmQm59UtUSfz3
MD5:	A90116D778858AF14B60F83DD27A7EFF
SHA1:	1191FECD91A386C54EA304672D229702823304C4
SHA-256:	33F9CB778DF0146167B6C71EF1877F54B8E1F73974941A63BAA083F364FF5EDD
SHA-512:	8E6E33DAB67788350037BE8CE7EAC2EFC768BC53573EB0288E700922DA03889D25EC464834D1BC1354DF221C9F7FE8BACE769B207C8F644A8E507C81E0BC7866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7544122152462154
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1To4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:WSnRTk243xmQm59UtUSfz3
MD5:	A90116D778858AF14B60F83DD27A7EFF
SHA1:	1191FECD91A386C54EA304672D229702823304C4
SHA-256:	33F9CB778DF0146167B6C71EF1877F54B8E1F73974941A63BAA083F364FF5EDD
SHA-512:	8E6E33DAB67788350037BE8CE7EAC2EFC768BC53573EB0288E700922DA03889D25EC464834D1BC1354DF221C9F7FE8BACE769B207C8F644A8E507C81E0BC7866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7544122152462154
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB1To4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:WSnRTk243xmQm59UtUSfz3
MD5:	A90116D778858AF14B60F83DD27A7EFF
SHA1:	1191FECD91A386C54EA304672D229702823304C4
SHA-256:	33F9CB778DF0146167B6C71EF1877F54B8E1F73974941A63BAA083F364FF5EDD
SHA-512:	8E6E33DAB67788350037BE8CE7EAC2EFC768BC53573EB0288E700922DA03889D25EC464834D1BC1354DF221C9F7FE8BACE769B207C8F644A8E507C81E0BC7866
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	582184
Entropy (8bit):	6.39307668121913
Encrypted:	false
SSDEEP:	6144:WSnRu0LWET8DS698nGX2OduCwUJWh/JmmS3DAjqnkrzFoEh+vMKC239YUFgBdQ/:lRu0LxT8DhyiLduCe/lSpn6zOvYUFg4/
MD5:	A0802D6DBC07DC6D5B6B6BBDEB520FE4
SHA1:	AA0472D48E0B50877D8EA3D4F5D1363EEA1901D1
SHA-256:	13D0672914DDC4CCB4D937FA62AAE703C450CC2059DB4C8A28A48821406CAEAC
SHA-512:	0A4872314FB93659C6A15D61A08437A93C39FFD89939F4065BF277F233FC8FA45C2DC639449039A79E77A58242F2970A9146A604D78076A393048B146A3EEE30
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3837992
Entropy (8bit):	6.442868237130808
Encrypted:	false
SSDEEP:	49152:dhB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EK:dtHzorVmr2FkRpdJYolA
MD5:	6E5ECF2F37BC9946248AECADD19DBF3B
SHA1:	B725E226C674DC9FA87936D22D704B15AADA57F0
SHA-256:	61441A4A9E27E262BC1DD6103999D11EE826A93979F5E6EAA5041535BED973BC
SHA-512:	B13C4A19A269A9FCEA9E597F55E02551078965D3A62B3F441EC53ECFBB4CCB8571B3411ADD527F4BE76284AC02813FFAE0EFCBAA230B083F2F594824484EF709
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161832
Entropy (8bit):	6.048262815726967
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYJ2VSd2ga8KActASiZAkXS1xU5M3XgcoT0cs4qIm6Y6:WSnRuYVSktVjv3Xg5T0FIY6
MD5:	4958DDD5E01103D5CD6341D85542192F
SHA1:	1F9BE54E774711E9235E093424F57853CBE87BBD
SHA-256:	88D1B14DA73C11A9D2DC733AB934A651A0E5287D3F323BD903F8D6C7BC010691
SHA-512:	536F4A3DA83E2C154922CC57BE987F1CD7038F180D74CF91464CDFF457D90EF4F7CD020713736A218D037FD62F91E5C63B71A68304B741F06F6D78AAF1924E1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1827880
Entropy (8bit):	6.5415961049916245
Encrypted:	false
SSDEEP:	24576:O2hDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmasGvP0:O2hDdVrQ95RW0Y9HyWQXE/09Val0GE
MD5:	E44E806577C969288037CA2A6B18288B
SHA1:	83738C421A84D3B50AF7D7CCE5BCAA046DC39E85
SHA-256:	B0DA1723B6109F07FAB3B9A6A614BABEFFEA5B5EA5C7B59F5E3E2C3152D03DFE
SHA-512:	2A70E0ABD7DD7ED092611F52586AC767B4D57631FCB81E249823194596F3A0F3698B7AEF6544782B6BC890BF8E41151757C5F9E51D8669F218F0CEA144AF41C6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1297448
Entropy (8bit):	6.515845730484088
Encrypted:	false
SSDEEP:	12288:lRu0doA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfouDMA+nkSddSDBDIq:O070E0ZCQZMip6Rrt9RoctGfmdd0
MD5:	D602CFC544F62FCA7E66446CD51DF34A
SHA1:	5E28871652685B3434E8B3AB0C26F927B93F5F0C
SHA-256:	DC6C64933489EE4FA3D1D9ACFF85FA1358C9EE0F38F1545BFCB67893375B0A18
SHA-512:	DFDCA2A03CB3D38C1AE8DAEAB46D95456F3E502C26FDFF78902DB95FA5A544FD9E42D84B1A7A3AFB2812753CA896BFAC747188349CBF87AD3F4EBD3E2A0E10E1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506856167263203
Encrypted:	false
SSDEEP:	49152:NbpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:NQehFLvTQDpB5oSOmlBl
MD5:	951DAC410393FB4D7B409C6D58536FF6
SHA1:	C1B3CC4EC357B8D991D7EFEB3CF60F89CE61EB76
SHA-256:	140F2E3CD2476B33E6D4C24238F0DF195EE5DEABC2C6896452CDE296AD86F9D1
SHA-512:	8C2E8AD8A2DEC8184FD95EA5B4CC541801027F774EB7EFE0596277A0135C4F5774597B285D6594B9962CC9C46076A9E86B3E9DF3D7B741C2EF84B494C11C93F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.5051964474158215
Encrypted:	false
SSDEEP:	12288:lRupyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0Q:OpiD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	1C9801E06783C51005F85B4B2B943945
SHA1:	B5A063D8A769A613BD062A43054C52D190714EB8
SHA-256:	667E23BDD9F7BB9C2BCBEB7A8D237146275FE6EF86808E73A12EEB47BA2BC03E
SHA-512:	48EE631DD74A9A55077BEA976036567285D7B48B128FBC7E751F13491E7E51615E442F4C55C07B0A03E0A58912B0170871A9E9D9095272AA6C4846228C0BDB4C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2327080
Entropy (8bit):	6.530210508570389
Encrypted:	false
SSDEEP:	24576:NyfD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPHkkkkkkkBoIeAz:NyfD3zO9ZhBGlopzM3HRNr00z
MD5:	DA8828EE20AE5DF168B333C5DD5C4593
SHA1:	34C8ABCAC1F4C614CF43EBC037E9442F52C96A28
SHA-256:	B231274DC97620A3D9F64D6F00E0EBDA2ED5E01069767B7EB7D35BF264363AFA
SHA-512:	DE97B32AD41955CC468CEDF150AB8EBFAD1119491E7282889CFDAC1ECCD97FBD199F9E1FD7765A0588E09848483407BDA314DA40B3412F471DF6DA8B644C6B77
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3790800
Entropy (8bit):	6.538238030460338
Encrypted:	false
SSDEEP:	49152:abTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl9YPhe:aaI72LvkrCpbxJRoIMx
MD5:	CD5335B50D9365A32AEF6575CBC44918
SHA1:	5B9CE347D38C213D0472AC95A7DC0FB9DE4DD0DF
SHA-256:	543D9129A745D6226DFACCA2D2980F767290DB1FB460E84336DA72AFD7D70D5D
SHA-512:	801DF2D72A08E872C2655968FB0BB710A39937356860A282F2CDAD701F050339FE89A9476B0F8D3E3D393BB37E53E0F0238B71CE38C2E1F96D376DACC7C051F8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\notification_helper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1535528
Entropy (8bit):	6.518085018192468
Encrypted:	false
SSDEEP:	12288:lRur406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwohMA+nkXo:O8W9Jml9mmijZiMnF+ZxmQWcbLw8Vi
MD5:	0CF3DAD59278DD593FA31FAEE6E8BBE0
SHA1:	A88054511FC58F604B0933F079078170170481B2
SHA-256:	A996A1A2C453D0398B2795DDFC06016FD1F29F0CBB12DD0CE236C5BBC2E2084D
SHA-512:	471B3CDBB0AD2CCF81F6CED7C27067C6522007C16724D7C97A6616621ABD82321691FFC74E4351D1576356BCBD368DDDD136A8336497EC3AEA9A693A23AF08FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.517085069378624
Encrypted:	false
SSDEEP:	12288:lRuP5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:OPwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	534F004B945D949AC6BD4E05A2B71F12
SHA1:	36C977252E4DB6FE8F2F3D3BAE084DC389F956B5
SHA-256:	0D6312BA9039138100A2365C826C495E0FD505F32B05EB30F59FF2CD21FCCF07
SHA-512:	A5C0DF69BD38BAFC6362932EE7F711F5BE48C508BF13EB7681EDB91B2DCCC0D8790F7E368568F4F0ACF314AD5FC0ABBF4FABBDE4271805E7F7A901E4E7245401
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	582184
Entropy (8bit):	6.3932559693214985
Encrypted:	false
SSDEEP:	12288:lRu0LxT8DhyiLduCe/lSpn6zO3YcWeg4/:O2p8DMeflpnIO3Ycb/
MD5:	D924EBD20C8EEC6B4A7E7D19A62C2B23
SHA1:	D34B4599BE7C1DCF1E19210E8A84961A87D89C69
SHA-256:	11200D112F41A858A0FEF63589F9AF4874F404A64D069993187B4862AFB61FA0
SHA-512:	F4DB63BB0D13CB5D0B4FD54446CFEA5E9F78A0F1BCD16487771911724055E150BCECCB700889AAE9F59E64FEC97E1F36353F9D8FA0C9F8373A37E1380D9DEEAE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\Installer\setup.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3837992
Entropy (8bit):	6.4428846837494085
Encrypted:	false
SSDEEP:	49152:dhB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8nsct:dtHzorVmr2FkRpdJYonf
MD5:	4AF34D22F34499A5974ECD1DCFEDE62C
SHA1:	55BAC6E2C4C42B0CD552BD7825396FD3CDF7C26B
SHA-256:	8F9385C562C63435AE7A23292E3DD6F761F75E58A94EE9F7EA13510740ACB15E
SHA-512:	7263356857460351ABBC6B01CEA169784912E5E900EB433F854C7B5E175E24EE190063EF971994D5DF1531C3EFBD651FEA9582E39954D6437A968A2B094C77B9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\cookie_exporter.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	161832
Entropy (8bit):	6.048439265115478
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYJ2VSd2ga8LActASiZAk6BKuBeU5M3XgcoT0cs4qIm6Y6:WSnRuYVSFtVLA3Xg5T0FIY6
MD5:	3303606DA29E0965D41FDCA16EA2333B
SHA1:	4430244B6B1140506D4B655CA4209763AE3A7C11
SHA-256:	DE0DC16E545D15905049E097132F7FCC412EDCD9BBB4B4F3071E7D895DD4326C
SHA-512:	EFE65C3AF6B1C993D42E61C73784309E941C419643BF23FF0CDB1AB5895107CFE84E461CA184487D82856872845B6D279B9F813C05174D96545B7E77580EED31
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1827880
Entropy (8bit):	6.5415826661706635
Encrypted:	false
SSDEEP:	24576:O2hDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmaSGv3I:O2hDdVrQ95RW0Y9HyWQXE/09ValqGg
MD5:	92FB12013B66505B89107C1C53662846
SHA1:	6B137A3CEE3CFB3A48AD83ACBBFF9AFE1102013F
SHA-256:	9F28C22CAA8C2FCB2B4FC33C38C0562EF46D5A7CE7E12C5A0A12180AFFBCCD94
SHA-512:	CDB4F28702BC1591AE1D9D1AF5C1D5173D7DB7EE86F01D131660BE8D07F6ECCB68BAAF28ACCED42B6FA65E72561E320614E1BF5322B22D8FA09D281CB13211C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1297448
Entropy (8bit):	6.515887936774684
Encrypted:	false
SSDEEP:	12288:lRu0doA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfousMA+nkzddSDCDIq:O070E0ZCQZMip6Rrt9RoctGf4dd7
MD5:	981D33DA863847E83369236C5C3C6A50
SHA1:	6FC0C7D8F7A4652B931E340C7D3D365CC14CB75A
SHA-256:	F3292EF682F68C56049A7DC74FD20C8F9E02EF1AFD679F3152C04D9EB93FE24F
SHA-512:	1897B01CACFAEAFBE267FCC361947E35418687CA34F020058213564BC2042FD02B85005DF0529263CA0324F9C021955CC1CE20502125B7CF82712F469CBEFA42
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506875983609165
Encrypted:	false
SSDEEP:	49152:NbpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9k3hO2y/BG:NQehFLvTQDpB5oSOmlWs
MD5:	475165172E47D3781220034A88582D53
SHA1:	CAC80BFCC01C05ADD311468239B80A10F6A27B70
SHA-256:	5C7A433A6006EEC70D0E54591405308B44C39BBBFFC180F2B0D49C99CD5D58CE
SHA-512:	449F28190B0B0C930CBD0B00A445582B4EF642975DC80B614E63C086E74FE5DB932C12ACE9041BF40848FCBB5027D89BF9ECF815F9A0B46524DABC60ED0DAEFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1319888
Entropy (8bit):	6.5050352761546515
Encrypted:	false
SSDEEP:	12288:lRupyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVKMA+nkDhF242Q:OpiD2VmA1YXQHwlklb8boUuWPN24Z
MD5:	FA06394CE051747DA29D017326FEA753
SHA1:	9D2D15D728B21E769699C8AD38DAB6240F3EA32D
SHA-256:	F2B67240980C2B79EC4CCDBBA82869497B54344C361865ED65E8FF9228FB3A17
SHA-512:	7213493EDDC6727F8B42C8F265456581FFF9FC2DF64483C8163C4302D25BC4D630D65FE4091AA474708B91F44998F6A8184CBAB493FB36CE8446ED20BBB68B78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedge_pwa_launcher.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2327080
Entropy (8bit):	6.5301597101300075
Encrypted:	false
SSDEEP:	24576:NyfD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPzkkkkkkk+oIeA+:NyfD3zO9ZhBGlopzM3HRNr0T+
MD5:	523D18072B3468ABCB6792A20DD95774
SHA1:	DB4042311774C5FAC2FCA48453D03D20032A1CD9
SHA-256:	803797E6684265F43874846B11EECDD74A9FF06C240872761C2180FF999576C5
SHA-512:	F3B97D549BE1F1F6AAE35689DB9976FC479DE66E8C2A0488914DFD1D8CDDC4C02B4CF6378FB939DFB22553418E8F4BDC8AA2368D07BF496DD0C8BBFB12FE4A98
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\msedgewebview2.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3790784
Entropy (8bit):	6.53819018027103
Encrypted:	false
SSDEEP:	49152:abTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl952hS:aaI72LvkrCpbxJRoIMP
MD5:	C49FA58A1BA6B48D39A80203D8E5D0A2
SHA1:	BE127775AB86C953B24B77C332A19D88F280FB7F
SHA-256:	6B64E064516505E35E72E8A79782CACE5FF1AAAFB12A052555F30DC1163E07E2
SHA-512:	CE521DFDAEDA66878261007C5AE1F59B43ECD4BF8546893D0D199D4BACCD05698ADC16C1E7AAC0D00E598345238B4106DBCFEA0698293183A52916E716A6EBAA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\notification_click_helper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1535544
Entropy (8bit):	6.518193816602208
Encrypted:	false
SSDEEP:	12288:lRur406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwomMA+nkVT:O8W9Jml9mmijZiMnF+ZxmQWcbLwlVN
MD5:	D0A0D31534D50F13315D7C344048A284
SHA1:	5673DDB5E6F0F2780C510E21309DB14EE6D6DD04
SHA-256:	40BB77E0876AF058515A7188C960C81FCCB329BA511B98AC4FC4A21DA997AC3A
SHA-512:	FACAF631435008FF44A6D46A3FD2B57FE94961ED40D591C01522E320B64F63D4A181C0C6EF998F5CAAB28F24726DCBD7F8D80218A2E54A38FDCF031397209464
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273400
Entropy (8bit):	6.5171651522719
Encrypted:	false
SSDEEP:	12288:lRuP5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkIogjkd9:OPwNHwoYhua6MtERO4qbBJTY6mY1u9gK
MD5:	0023A9473952FEC9E35DC9CA356D07E2
SHA1:	56FF07515662691116CCA666A687E627434C88D6
SHA-256:	2FCBC4E2E16DCB4B82A5709C405901C79DE3371597DC2CDB1C2BFEB0D6392C8A
SHA-512:	F4997B6B9C0F54DA37BDA98987AADBD4B9F8D14CAC1D699716E4766B4CB16C68B67EB2F7832962ED5D839FB5C83F6CBC11D7A01652947C12BDF39E8AA12DB4FD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506875983609165
Encrypted:	false
SSDEEP:	49152:NbpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9k3hO2y/BG:NQehFLvTQDpB5oSOmlWs
MD5:	475165172E47D3781220034A88582D53
SHA1:	CAC80BFCC01C05ADD311468239B80A10F6A27B70
SHA-256:	5C7A433A6006EEC70D0E54591405308B44C39BBBFFC180F2B0D49C99CD5D58CE
SHA-512:	449F28190B0B0C930CBD0B00A445582B4EF642975DC80B614E63C086E74FE5DB932C12ACE9041BF40848FCBB5027D89BF9ECF815F9A0B46524DABC60ED0DAEFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1319888
Entropy (8bit):	6.5050352761546515
Encrypted:	false
SSDEEP:	12288:lRupyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVKMA+nkDhF242Q:OpiD2VmA1YXQHwlklb8boUuWPN24Z
MD5:	FA06394CE051747DA29D017326FEA753
SHA1:	9D2D15D728B21E769699C8AD38DAB6240F3EA32D
SHA-256:	F2B67240980C2B79EC4CCDBBA82869497B54344C361865ED65E8FF9228FB3A17
SHA-512:	7213493EDDC6727F8B42C8F265456581FFF9FC2DF64483C8163C4302D25BC4D630D65FE4091AA474708B91F44998F6A8184CBAB493FB36CE8446ED20BBB68B78
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1273400
Entropy (8bit):	6.5171651522719
Encrypted:	false
SSDEEP:	12288:lRuP5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkIogjkd9:OPwNHwoYhua6MtERO4qbBJTY6mY1u9gK
MD5:	0023A9473952FEC9E35DC9CA356D07E2
SHA1:	56FF07515662691116CCA666A687E627434C88D6
SHA-256:	2FCBC4E2E16DCB4B82A5709C405901C79DE3371597DC2CDB1C2BFEB0D6392C8A
SHA-512:	F4997B6B9C0F54DA37BDA98987AADBD4B9F8D14CAC1D699716E4766B4CB16C68B67EB2F7832962ED5D839FB5C83F6CBC11D7A01652947C12BDF39E8AA12DB4FD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225232
Entropy (8bit):	5.777768375287633
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYFcxiNNpCPPQPg2cluc/Xswbz8cz3quKoNX1gd:WSnRuFcwVz4B8c37KoNX1q
MD5:	F42DA6671D6AB710161B4F7932B20682
SHA1:	876574647434374BEDF68D1A4446B427DBD905DC
SHA-256:	CBF28F6433E111BBBFDB6339ACA78B9E9FBABA8536FECDFE12D3BFF40EFAB3B8
SHA-512:	5CC0FF36457AA83241AF345DD0C951195060D885039ACFB5644E6AB5641B70788F2D876BB7183381F2BDACD6CED645A08037FEF6249C4EB0D77B7CC6143A1763
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	247760
Entropy (8bit):	5.676963353520786
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB84W4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEt08:WSnRqul/DRfkTC3dM7B+mCivAT
MD5:	410F2AEAF9CD27CB726C3500FFB204F9
SHA1:	8C87E6866D4BF198A76A91DE32038664562F006C
SHA-256:	C06F7AA20BFBA432DCF99642D0AF67670ADA8FCF4F4A8FA9815BC8BB8FA6F765
SHA-512:	C80BDC592DA20C4828267A1284AB0DAEE85DC3D2FA7CA85642FC5EC69775A24950ECAEF58EA656E41A047165D766458BDA770E997AEAC4067F2AFD1346BD4B43
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.344507347713185
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB8E684ePKoTB+IvoAewtxUff8aohGme+YDfYz8FrR7:WSnRqYrTB+AleYIkifYUF
MD5:	589A988F85C28363C1873E06D21F8F46
SHA1:	47E96ADE8887BF8FFD9BE9E9E9A48EC86ABEEBD0
SHA-256:	711E0F11CDADC726D9CBA92177AFDD6470FC7A304B2B07259720817C6F4E30B9
SHA-512:	AEB329E3F70DC13693290E3881F7F7E3559AE4E91547B2C22299BE79120B83C2BBEC0AA6A8AF3616C933F1BF1BFA8D66B9E49B9860F8301E0EC07F8C2CC0AB24
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	259024
Entropy (8bit):	6.025918040872977
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYTXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YXI35EvMl:WSnRuTUVwleMITTmNv1ohWsqYI354I
MD5:	779B35E2F09C54BA594C189D483FAD36
SHA1:	3BA1870B167B8F06C4B5CE29764201780903FFD9
SHA-256:	678439E3534206163C0BB4938E856387BDB8A6EDE5C9215E33A1FCB89D01BD9F
SHA-512:	B0F48515C78C322C65EA4D40CFC65654F3B9285302C6912BD5DC25D48722AB5A4ED3871D53A393B70483988C02F7DBA77F5EB1E32B76A148837CC2070C496754
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	305120
Entropy (8bit):	6.391200173583434
Encrypted:	false
SSDEEP:	6144:WSnRqeFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++CgBlPMoX:lRqMKucTm3RhMfoSBjA9U2Yxh+Zgb7X
MD5:	2EFE1E106ABE7DC0548E41FF828D9F8D
SHA1:	C3CD180682A952D37EB2D9D91059E126596F7339
SHA-256:	6FD5B3DE688B9AA52367C3E4CD67739C711821FC80FEB60EEBBC18095B90FBA0
SHA-512:	CDCCA1660DAAE65C23D2905CEB12D535B16AF8E1E21150EB387295DB7C68FB1916684B7143EDA89BD0D1D6589D9CBE2621CEA1D289F7D688497BFBDF2E83E95A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.345314205002919
Encrypted:	false
SSDEEP:	3072:/OSn2M4MB8raivqozB+IvcZ4wrZU+l/8xoAm2+YDfYz8GrR/:WSnRqbzB+Aw4CZNr2fYLl
MD5:	3539DA444C30556B019FEBEFF5C174BB
SHA1:	0032E2C9A0729D23221BD89665DF0852833B2CEF
SHA-256:	3195278E5DEF6B93FFC28804F6243C5B4206BB32A6B533149C8F438F74F88354
SHA-512:	65C3E03D09FB15B86A92AF9039FE9DDC0267C395A59E5FC58E25D791B91BE91E00B0352FFC9E2394A09AA84EBF63EE2413B47D2E1B2D9F272E71C524285B3EF3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1640416
Entropy (8bit):	7.908100353802146
Encrypted:	false
SSDEEP:	24576:Kiwy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUG:KTy53w24gQu3TPZ2psFkiSqwozX
MD5:	73DE616871A596CE049436097F7B3059
SHA1:	27570FA282CA520267EF75A97E3CCBAEFFA965D0
SHA-256:	D90B31A57EEBCB49287C81E58B7381B5B46F7952672CF500DFE3057CBCDC99ED
SHA-512:	BC539400F2E153271E6EBCF29317B3C697CEDDE509A1E5A0D7FA24EB7498EA39C08D15A314AFDF7BC6B762E6096A6BFC6234392A4730F9DC724C733B07ADC6DC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144866
Entropy (8bit):	6.143555123168523
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBQcRD5b0qZ7y4jem7y6tkNRCywDw1DiJkuKUY:WSnRyuD5lZ7y4j9KT4DteUY
MD5:	1D90F747B558FD703BEAA67E7ADDD4C7
SHA1:	87735047C69007C1B4435122972B8E3CB585382F
SHA-256:	9FF064806E416ED22908645F91ECE5F1966B3B1EFC8263E76578EBC79380EC4E
SHA-512:	74232BB0520AD3645DF2C8B63E5C6791F34B47147F23ED67BE3AFB5BA9907A8CEFCB4369CE73BB8385E90B49403BBBB9BB1E24C9B6D02BAA88BAF30F3CB8E47F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	280480
Entropy (8bit):	6.341458571504574
Encrypted:	false
SSDEEP:	6144:WSnRu6Pr2vXzrEbslNp/JNsJKQl0GkRAqVNf0O3:lRu6DQXRVTZu0GP+ZR
MD5:	757F2351FBC058B3DFC95D8766F5AFC5
SHA1:	00BB628977825DD4823EE307DA16A5E2938E141A
SHA-256:	B9AD8E846145E22369C4BA68C272729A3EBBBC6A9BE82ABEE34379E8ADAA3A56
SHA-512:	5A6651BAC7EF7E1E04553FB9827FAFEA0CBA991F86922CCB688371341F829734C6CE530708E0919D0AC8870547F05E719A562CDE70FFC3A4DFDE4A519C019344
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.5699065121213245
Encrypted:	false
SSDEEP:	98304:OKkkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:fkkCqaE68eV+0y8E6L1
MD5:	95AD11F27886369B96103876974CD3DC
SHA1:	1C43996D701767A2A80F69134C07E256391FB28E
SHA-256:	CDA1CB735F209EFB9B3B648FA72D62B23927690259E93E851AF87003C9D7BB7C
SHA-512:	BDFEEF68118EA4BDFEE171EF7C855961A64D8E1AB7C3F7351C9BE653CDE070C29E458BFC0AF146ADFFA87DFF4EE421A401C26BE051D80A9CE8CE9E2B9013BD2E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	501656
Entropy (8bit):	6.301636835335393
Encrypted:	false
SSDEEP:	12288:lRuhLH18t6x1hjaNHBlfBVDZS82JninSFVlDW:OhLOwxyNHBVEHRiSFVlDW
MD5:	FE79118B11B2198238333C21A18C349B
SHA1:	522E36340DD35D4DDD6BC961B7E1CDE50EC0CCDC
SHA-256:	8EEE31DA73DFB50B309FB94C70E67D4167BCC3AB026960842B973F0C7393E5A7
SHA-512:	157D899E9EBC7F47F722E8971E99960D260FCF45C471BD94641C8C036629D8F8609BDEB410370DCEB39092B5660B21C6B92CA078B2EB7D7867560F36515A30C2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1637776
Entropy (8bit):	6.312902506639943
Encrypted:	false
SSDEEP:	24576:Jn7Z1jyzcKSmKsvwMZJ1XBsn/gu2bRC6dulyyn2WdXM6cWlLIJ:J7Z1tKTwMZJ1XBsn/UC6dugWA
MD5:	084B65610D4B98DE0E9892878BACD476
SHA1:	5566894749A26E0FF1A3D6FFC75F894ECAF23398
SHA-256:	22B5E5299985FFAB6145DB6DD0F4CEC6834AE987CCFE83D77C2B4876BAE4A693
SHA-512:	D057D3B2147141B90A2F327493748992502A3BF995793E8BD10E862088746A566D8E771D389F568457E1C35C5CC8BFF43CCCCE25CBB6B39091EADEE632D9051F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224632
Entropy (8bit):	5.580579119980098
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBbiFtCsHjgU7HOg6KTe/+EypudsD22QnSUEhydebz41:WSnRpItx0SA+EySaQKeUz41
MD5:	C0228F0C66D2ED889F35814671391275
SHA1:	BD73EE0DFB858F4B40796E36D73FDB15506E05C3
SHA-256:	3077C7579D191AD467DBFE5BA169214E1805249854C4E7D522F39A654EE8699D
SHA-512:	E49518547A3EFA2481CEF8148421D1F4C3D40FFAB13768F7FD183DE0640D38357DE996F140CF1DEAF0219D9B94C6E6A5FBC7DAD74F05F5BDA0A3F6F026DAB0A6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	431336
Entropy (8bit):	5.876948978617386
Encrypted:	false
SSDEEP:	6144:WSnR+4zBRUKCBTwZVr2miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jV2:lR+4zBRnCBOrsBOBf
MD5:	7D32EF5082B135D1627104E6FC032D3E
SHA1:	00D5A3F56973590F708A54B6BBC3DA42FC73E2CA
SHA-256:	EFF0AF09D29DB533D834B1165866FD7E599210E6ECFB1ADEBC2E69DFA839E070
SHA-512:	596FBFED06BEA082B70296B80BA27A8F978E371667365ACC0EF6C8ED3B181D5EF8F8172FF141F8FBAB80D2E692F921CC34525F2D84D30788CEE66B7DF4B42237
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	175160
Entropy (8bit):	5.90811096008999
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBY2/VpSIcnsHKTe8LnZCA5OfkQAm95kQOJeqx6u:WSnRu2tkIpdA5OfzDUeqx6u
MD5:	20D992EADD8FCACAE8561E1611195081
SHA1:	7D6BDC7A45239C37002D2A5135E938314AB001F2
SHA-256:	4C40805CA5212520311F6FB366CBE12785E2D7CFB42C1F70F4061235A65D527C
SHA-512:	0CBF419412790FD17EFC0D61C1CB67C0765156E83E9DA1950666E550FBA0B9A6BFED06ADA7ACC0AC97E1AEC0914EAADD4AD756FA779CA2EC83C4E93F02C62B4C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3162480
Entropy (8bit):	6.469117878247466
Encrypted:	false
SSDEEP:	49152:OgnW4jqFRZega3xejvY7GQOx4K1fm15FKqO7t78Ity6fod76lmlW8U:OHs3OBj4UmOH
MD5:	EB347161293016669C1ED0D648D3CCFC
SHA1:	0831961A04B24DA2775977D195A8C41C00EED9BC
SHA-256:	19E6F5C3A59410B7BFCB6483AC79C9E3063634DB544426EBB6CAAB84792E4D4E
SHA-512:	A1547737529988C5C8B7090A471FDD462B7550BC93887475BBBAD66D6B643511502BF90A20334AA335F990A104743EBD72D03F0FB0E226F20B9929C1AF5240CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1309408
Entropy (8bit):	6.496810384500629
Encrypted:	false
SSDEEP:	24576:Jx+sGOL9NLM3r4Viwj6KLqGua43loEeUFmwv:Jx4AA4eGua43lgUFrv
MD5:	ED0BC627BC9F9B42DA40B725E6ACA997
SHA1:	C0E6308F8671F529ECA4865005E7DFE01145F102
SHA-256:	6801DA64CCBB308179BE08B90C0655D6BE2043D6E4593B42AF608047C296F583
SHA-512:	6AA6019BA89D51681F29279663C20768D0303F96B748191BD5CC5D9F5CE7CB320424FB7B0A325D61A2D2A1CA359F5F2C47BD5EB19E90AC1FA884DAEE0F330143
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	922944
Entropy (8bit):	6.457457929775334
Encrypted:	false
SSDEEP:	12288:lRuO9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+poPCcqyt4:OI/BrnYuqFcL3pQ+pDX
MD5:	3FFCA810B36AF173F7A635AA904949C7
SHA1:	BCE74843A6778F33689A9AA9D3B9EE74100A9FE3
SHA-256:	72249DEF72C9B751A5C6ADFD60D561682E6ABD629ADF4171683D52942CFF8866
SHA-512:	423E19C00455D329A1BD56A47B9E32705002BF81CFFD7AB31D7F24BC9C4628714AB805F67C34B852D62BDCA43AAC98F100F66470843D4E26C3F399DC6478162F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	501544
Entropy (8bit):	6.30098331233543
Encrypted:	false
SSDEEP:	12288:lRuhLH18t6x1hjaNHBlfBVDZS82Jn8YSFVhwDW:OhLOwxyNHBVEHR8xFVhwDW
MD5:	4C65E6B6B041835580CE01C19CA124BE
SHA1:	D6B48C16E5D050FFEAADD9E371C80AD81AF9090D
SHA-256:	AD5EFA56C132FA5872A7E3C1DD0563FE177BAC38F138859AEF193FAB7CA1DAFD
SHA-512:	66A5A46F0F129183D8D10E1417561FD4552A00CDDFC43D989C13BBBC7E5E7548E3B0D220B1A33E74437EC4C4620B4EBE178759B0876A8475A64EFB7ABF895024
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1637776
Entropy (8bit):	6.312953149394688
Encrypted:	false
SSDEEP:	24576:JnzZzKrsdCmasrf9Xr5wzW27+w3E4nZ1jDkCZTunfmrd/Mq8pqiV+yeci+HMJ:JzZ5d3f9Xr5wzW2x3E4vDkCZTEJ+3
MD5:	571563426ED7E6C17069E7B428BA3EDD
SHA1:	8868DFE1683250BD34C653F3127C82BA94022A49
SHA-256:	7682FED9BD1B79F83D95CDE53C6EB036FEA423FDF18D2511361A8D05363FD1D8
SHA-512:	80BBA0670133A7E1EEEDBC0155EE826AF49FCBB610E7D6347508578287C8D3FD49733FEDA0EDF787F084A6903BDC776A7A12A863F6984530FA35ED62E229B60C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	224632
Entropy (8bit):	5.58002790931879
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBbKNzQsUdR7ROPHKTeA+EyBEBsLj6mCv0MC+8w+l+jDYgb:WSnRpozrUdH7+Ey6yxCyncDYgb
MD5:	54D7A18FECFD146896C3BEFDFC5E342D
SHA1:	69F761138C2CF65A50D3DC9198C3D01873B38914
SHA-256:	EFC973E6D3F59C3582E662E5759836BC3DC46D85BA2D9BF13A9698334C02E432
SHA-512:	BBDFB8264EA513BDF9C8A17AA8721D1BA19A4AD481C9FC2F5778F1FDA61DA5A665A4B0FA27B0A437F9216BA9787E9F9801D495829000D16550403228185D4413
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1922888
Entropy (8bit):	6.54140779388885
Encrypted:	false
SSDEEP:	49152:OaxzduwxBjJMXDUlxqK/PDLWf+kfilcOk+4AgAQx:O6uADax
MD5:	56DD9AF60A56380920C57601D89D9AE4
SHA1:	AA06F8E2958E178448A7C316086D896E35B04E52
SHA-256:	6CA9FCDBA99168024CAD09D047A32855AB375986877C31C3CC4205D81A24034A
SHA-512:	22FACBCADA2AE391BB6B719736EF2DB75FB5B866C69F87BEB0464B6086D956769FDCCF5A5413D1ABDF581920ABDD38D51AEFB46E51B8372F25747740206E730E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	431256
Entropy (8bit):	5.876515640602381
Encrypted:	false
SSDEEP:	6144:WSnR+YDBRMKC2DARcy85smiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60N:lR+YDBRPC23DWqOhf
MD5:	4C8DE602A1EBF3B27F1F90C3B4F50128
SHA1:	2718201A1DF2A8D38F9139CECF3328D3E86ED7D6
SHA-256:	ECD2B9C04D2C26CB6FD7B41034669C9A466C7F50987C66DF4107B3D4AAF3918B
SHA-512:	F70A88927DBDE398E073939880D44E4C9362647A3A8F9BD0B493A9D00D457D33A85B03E7EB652A3525AF89BD8BED80A1ED57C32A634B0E3521DA8A6F1619D38B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	175056
Entropy (8bit):	5.910209990648919
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBYVBGrjhgGcKTeA4yJjAYykykBdg+FoQOJb/B1a:WSnRuVgfhFAYykySfUb/B1a
MD5:	7AD46DF745AE2434547D20A6CA89753F
SHA1:	D19784F4A0DA48E04BC3E0F649B5CC94353CD609
SHA-256:	4320677BF7975C472A05BC023BAA678BB203755935F3D8EE3865E6178179D857
SHA-512:	FC3105CAA73E72A6882237882113A24F58B60E85F01E06EEFFD64BBB83488DF2FF3C5C656C5590EC924BCD8989B9E1831FE45FCE482BEEC6FE9594EA363B517E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3158376
Entropy (8bit):	6.46459226924511
Encrypted:	false
SSDEEP:	49152:OD7Inw/bT9uzlAndnpufoDbRwU/xv3lNOsWReEQZeEO1QOiPQOo4r+U:OP/VmUAYrj
MD5:	E48D45814C1F8E926890BC6703F29939
SHA1:	BAA66A1B749E4FD95C80679A887821A28CF97F2A
SHA-256:	1979F0E9FDEC3FF4560FA9D888E737A4593010542695480B85A6CA5911FAF473
SHA-512:	D2A23B0B56E79345AC6283E1E1F3FC8011C825113333FB421416DFDDE3C982A624CBE573C83650382362E7A5DBD8EEF1D53A4BF0C6E4E55A69BE08ABAE0D1EEE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1309536
Entropy (8bit):	6.4957844167284975
Encrypted:	false
SSDEEP:	24576:JbvbIUnHtg+i54V0tqDNbu5kDIPQy+NTD4XnFzr:JbzXzdMkDIPQy+Nv4Vr
MD5:	5D934FF862CC297FFA235F4782C5FD9D
SHA1:	886E6AA59D35434FFB3F3619C5FC308D95E70E92
SHA-256:	461D4B3CF9206A0085231CFB243A1740AF16AF40ABD85FDA452E34A9520BB6A1
SHA-512:	14C797A9FC7CAD5948D047393E92E628AB730A82A8AA4BA443739184A31D375AB971650F1F83F3DB9EABB4C1EE7CC07D3225D3DA9B89FBA62B99DE1AE7877112
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	922960
Entropy (8bit):	6.457534594019194
Encrypted:	false
SSDEEP:	12288:lRuO9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+pouCcqC7D4:OI/BrnYuqFcL3pQ+pYmE
MD5:	C279EC454589E306A49D44F6072E357B
SHA1:	538EE7B2B531803892867F44C11C5DC783693B54
SHA-256:	044866F91A16006162D4377B30D4A28F33D54EAA3D26164B7AEA5FD1065588C0
SHA-512:	54A6FD1AB0E25CD19CD22B7D7F06AEE487F4938643EA90FF0DEE5979FD58526401BC2AD377AAA9BD2045B3D2628784DA67019395D56063827EFD42091A3A585B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_iKHPXKiqI.exe_8cf6f1bb73c4a69833becd4571ee63fd323f1b8_4f01b740_dd80d1a1-d7b2-44f8-9e93-df8a6108e173\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2525651432920988
Encrypted:	false
SSDEEP:	192:hzIBPYZk10BU/iaWeJo1ZruKxrzuiFDZ24IO8oj:VIZuNBU/iax8NzuiFDY4IO8oj
MD5:	9F82904E568542159F955DD26611D131
SHA1:	BB10A3AC5114157D66D79EB25228EAD5B1670745
SHA-256:	BB8D1E1985BEEFC85B3B6CDCA75741E737B753A86E99F9C3C7E723937432B878
SHA-512:	6A62F86E51C40F00E34238EE24B7814FFB7B5AEEEEDEF00D5FF11C3773D949F174F92B9C28FF02D70CD06FA1A60B7A09AB6858B68EB173690EB277CB76DCBFD6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.5.6.6.8.4.8.3.3.3.6.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.5.6.6.8.8.4.7.3.9.8.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.d.8.0.d.1.a.1.-.d.7.b.2.-.4.4.f.8.-.9.e.9.3.-.d.f.8.a.6.1.0.8.e.1.7.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.e.4.a.3.7.f.-.9.c.9.8.-.4.9.3.8.-.b.3.0.0.-.b.0.e.2.a.b.8.b.d.3.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.i.K.H.P.X.K.i.q.I...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.W.m.Q.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.a.4.-.0.0.0.1.-.0.0.1.5.-.d.8.c.5.-.2.3.2.5.6.b.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.d.2.9.6.b.d.c.7.c.a.a.e.3.5.9.7.c.d.9.0.3.b.4.b.f.6.1.6.e.3.0.0.0.0.0.0.0.0.!.0.0.0.0.7.a.b.4.0.8.8.c.1.6.2.a.d.7.0.f.5.4.5.6.d.a.c.d.1.f.e.3.4.1.5.0.e.2.2.f.9.e.0.d.!.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER99B6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 16:51:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	335194
Entropy (8bit):	4.050770935519418
Encrypted:	false
SSDEEP:	3072:bD4V5LTg0mpxlit0ZI1QIM848c4uEqRByGIyEKJb3:bczTgdK88c42yA
MD5:	639ACB4EB4856B152ACFB3404EAAB729
SHA1:	29956222616322EDF8D8889E1C40B2E4AC0AB052
SHA-256:	D65589E948E0B11146AEA5F202ADC652F04CC6681806186FF34090A6CDE20615
SHA-512:	82F1B4540EBC4DCEDFE1885F3B95B817B7E320DDFDF16CB19C42E2E54354CEC6B09C5B3E8BD197D10D2AA8BC3BF08963F1B49475030222F4E613403E11FECB9E
Malicious:	false
Preview:	MDMP..a..... ........?.f........................0"..........<....,.......-...f..........`.......8...........T............D..............T,..........@...............................................................................eJ..............GenuineIntel............T............?.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA4F2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6396
Entropy (8bit):	3.7252350386933
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbp96LYYZUQE/dPlp5aM4Uq89bWZWsfSSgZm:R6l7wVeJp96LYYZURNprq89bGWsfSSim
MD5:	D644257F76AA0B4D8EA3CDCC83B12940
SHA1:	FCE9E4BBE8EDD456697E3CFC364FC318204C55FA
SHA-256:	95637D3872B96C434FDE854E85A03B69DBB9FBFC70D70F7BC292FE0BB6757189
SHA-512:	D5B2F8252C716B366289919F22E40EE868405A47FFA16C65457E4FB0F0277EFEB55FAC3C1F071229E58D956A7CF506FD45722CB3D4DCD9F43590279B99406075
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5ED.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.484593462589103
Encrypted:	false
SSDEEP:	48:cvIwWl8zsrJg77aI9bwWpW8VYjXvYm8M4JtJWKuO7FB+q8vLWKuOaoVT4ymzWzHd:uIjfFI7NJ7VQyJmDWKCDLoVMywAHd
MD5:	B64A97E98CAB77F76427D9A6A8F919B3
SHA1:	F1204E79EC4703A2F6395DA8454161E6ADBC887A
SHA-256:	555E7539801E9DD37EB521ACD68DEA0EBA9A2B7732A64C6AC1C555D10816A608
SHA-512:	8E96AB0E320DCE8B6944BD875242C3A60A2020AA0810BA3DB2AE95A6A656F21EDCF0F76B051B7388D707CAD2CB6A98452E0C30A7042343497963DD06BBDCFAE0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515994" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	692064
Entropy (8bit):	7.182558594964572
Encrypted:	false
SSDEEP:	12288:lREhskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNmnMwJ:khsZgjS1hqgSC/izkfFjymk4HM5yJwMK
MD5:	2258574BFCF606373D5B078B7C6FCDFC
SHA1:	6C1BA0209DD50A97058F2A71CEEC86519A5E4CA6
SHA-256:	BE25B9B197ABADBA2C80DA2774F2EEF43E24860A992246B6A05E2CEB06167BFC
SHA-512:	7CF5A77B6FF12F58214D8C4D9E96A70999CCB958CA0CB3C0037A382104AF170ACB073BC0C1BF5081B46D09A000FCD5F91C26A55BC5BA68EDFA5CF481DFEEA0CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Plat#U0103 revizuit#U0103_shrunk.exe.log

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeoPUyus:+LHyIFKL3IZ2KRH9OugYs
MD5:	9AA3EC09E507E3B6521730FDDCF550A3
SHA1:	19E688C78EB2FBE0D620C0055293DA06411512D0
SHA-256:	E50F69B84C0E4B5D2CFE80C5B7B4AF6398A862F098D06B138388F7D49ABAB0B8
SHA-512:	04B3A49C7FB0DFFF413095AB046296C779A1978D64CDAE35858435A5E41221AE6726421F1FB116EBF7E2DB314602A544F5C8AD7F0F96FCC04D694AD6C1E78E81
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\3582-490\Plat#U0103 revizuit#U0103_shrunk.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	data
Category:	dropped
Size (bytes):	1551360
Entropy (8bit):	4.753456765595388
Encrypted:	false
SSDEEP:	24576:n7kAAvlv5nN+BqIJomwcwm/V9ABJqbBmosSNutI:QA22BdJoQwwYOtiSQ
MD5:	BDEE1899F636D007853701696B14F48A
SHA1:	A67E4106B19F878755149F51603F73FE3B4F339D
SHA-256:	6D1E5ABE85E35A135069DC1E80600681628F4B827E0F732AFBF904F56B1FBF9D
SHA-512:	0FEE25DEB6D429A81E0A91F2070188D27A625D7EF9A69D9AA0F4F39020FE22F1422E29E8A42B8193A7C50A18C7BD54A176B192556A33196643FDB36696D94C61
Malicious:	true
Preview:	...3E.Q)^l.y...J.].S..N)Tv>.Gz&.I..}...#$.......4....>.K..~....V....2$...I..G.)E..,(D-..H'.........a.o.}W..$...1.:.@].PP...QzK...h....xf........F....(:.] .N.......O.Sp.XZ\|...-.} .f4....Sr9/.......%;.o.'./.`d\.s.u..@^..A...\\..t4.../.DK.t.0.9.R...Ed..>..k.&.Od.B&J..T....A..('ij$...:..{.].4.j..(......6..~...........]Q..B.....\|.`k..V.......Z.....{.<2o.....v*.....m.8...x....6'..0..wo%.....7yf...P..J.v8...WMx.h..@.X..o?k^.m...t..N=h..-..R.w..i.$.w'O..{"v$T...'-.FW?........0..\|.0`..L..WZk...[.fF.<b....91i...^_....:..~.4..n..b...d.F..]i.../...E...g\|...R.E..k.H.Uln.\..{,Rj{Zv....t..jL.G..@..x..8...D.<zY..j:}.@..U..).p.......l.....B.....[.3...b....w...G)".!V'j~.`KF.K.=_..Cd..i...p...=..C.yt...l;.Y.......[....C...rb+.x#..q.."1.Y.o.M.h...7.l..m.......Q..EB.`.R.-.._'Ax.k&..Mc...+..)ZK.i7=......H...v.-.>)...B..jmn..i....d..c.....Ff.w...&.5.(....C.B2...&.I..OS.....c.zi....G!...>.c.....G.<f........U..]Re.J.....PK.7..m.E..5}.R..n!..8n...i..wv

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ah5oilww.euw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iwpa5zab.z24.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kusuwbis.xwi.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mr53nlb5.pu2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rigokiaf.bho.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vprijzvl.exw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1ycrxc2.jxp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ye04fsqm.luf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.7439077710770565
Encrypted:	false
SSDEEP:	3072:/OSn2M4MBf/VWLuzeHpl18fCtnRPF9EVnb43jaI5gr/uHqZLWfp2KkvL5kdnQB:WSnRB/gmCtnRPF9cCGr/uH0gkSdQB
MD5:	F259474A65811E3AF620D82FFAFEBAF3
SHA1:	E7BD8628975FDE442359419173731B8AEECADF2B
SHA-256:	1B1D6744B4ACE10DB299D1B003DDA1A9FC0AD5226201D0E7DBDF30C1F247074F
SHA-512:	946C7DBA9F1493B01FAF6DCB6F3CBFA7AEAB444CDFA65F33F57A1154252DF20F526C75D6BE145A5E6190C856CB873F9B374C8407DC37BFFA45A8DF645AACD83E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	data
Category:	modified
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:Bgck:Vk
MD5:	D16C68EC6FE1685AE9F668B44B17B79E
SHA1:	9CB4FB41235E8B29D13197395F66E5714D578CA3
SHA-256:	F40D603F113CCB5719F1F80D4ED80911AF9F6A5CCBE8241B278E2C55E739E0AF
SHA-512:	93E291BB3BB8192046C99C6F928117B00298386F393A8DC141D2AB831A6946FE7BD1592B799374289CE3303B9E2DD4D25876958496BEB384CA717049FF1B5B62
Malicious:	false
Preview:	.....&A

C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1596
Entropy (8bit):	5.102563950163282
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLiioxv:cge7QYrFdOFzOzN33ODOiDdKrsuTuiIv
MD5:	2D46D175DAEAAC85A35F484AEFCA4E63
SHA1:	874B060CF631459DB5A083086ADA1A0A24B0A1F2
SHA-256:	A8287B8CD0E79B276FCD317D2E0875D91FAF2EE6BDDC20B0717CAC1C4DE93558
SHA-512:	00639BCA6CC277DF3EB4941B9CC31CBFF597C9CE32696EF17ACF42B0A4E772D260B3D898F575F2E9EE8BF197296BB5EF2721FE3DED34F09F4730BAB0B37F8777
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmpBF9D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\iKHPXKiqI.exe
File Type:	XML 1.0 document, ASCII text
Category:	modified
Size (bytes):	1596
Entropy (8bit):	5.102563950163282
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLiioxv:cge7QYrFdOFzOzN33ODOiDdKrsuTuiIv
MD5:	2D46D175DAEAAC85A35F484AEFCA4E63
SHA1:	874B060CF631459DB5A083086ADA1A0A24B0A1F2
SHA-256:	A8287B8CD0E79B276FCD317D2E0875D91FAF2EE6BDDC20B0717CAC1C4DE93558
SHA-512:	00639BCA6CC277DF3EB4941B9CC31CBFF597C9CE32696EF17ACF42B0A4E772D260B3D898F575F2E9EE8BF197296BB5EF2721FE3DED34F09F4730BAB0B37F8777
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\iKHPXKiqI.exe

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1592832
Entropy (8bit):	4.803426897193995
Encrypted:	false
SSDEEP:	24576:9D7kAAvlv5nN+BqIJomwcwm/V9ABJqbBmosSNutI:9sA22BdJoQwwYOtiSQ
MD5:	8ECA59816DC6007AE4A40DC09AC5B66F
SHA1:	7AB4088C162AD70F5456DACD1FE34150E22F9E0D
SHA-256:	D4F4AD6EA2E448166EDDE53A24011DDC5C4E870F7C571F9DD5E390E582CA3D33
SHA-512:	39B82C25A917169C47A19EC29F0DF724274BA4D08E711B0D66E91B131DCE4AE41E5DF7F9688F1C1D6CEB3138900158736492DA7746B76E4CB0C28364EC922043
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

C:\Users\user\AppData\Roaming\iKHPXKiqI.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465896839858844
Encrypted:	false
SSDEEP:	6144:wzZfpi6ceLPx9skLmb0fBZWSP3aJG8nAgeiJRMMhA2zX4WABluuNLjDH5S:mZHtBZWOKnMM6bFpZj4
MD5:	B525D553D88E5EA1067BD259779BEE1E
SHA1:	62550F05FDF32FCFFB1D78F1D61D793328A3B001
SHA-256:	5E18E0B0450F2BDCD5B8C35A435C0169341AD731C19D5DF7046176257D19050E
SHA-512:	7ED93D1A713A8DA0B775660192B27422B99E8AC5D8A90CCCFCAD28520F5ECCCD57E9F131F02122FA9C5AEF0E250148582477FC894A2984F90D63F01A4A42DE53
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm../%k...............................................................................................................................................................................................................................................................................................................................................[i8.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\svchost.com

Download File

Process:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	6.079881828278654
Encrypted:	false
SSDEEP:	768:/+9Fan98uZWdolxDuB22ttSHI0aBA7rtmq1y12ii9BD:/OdUn2aHIFMBmFw/zD
MD5:	5F27263890B97EBF8E2EF89555D34EDB
SHA1:	26ACB10564220B18EA28F9883E3E0E53AF98FED7
SHA-256:	51DE55540B2B7CD2E2408F9F7938F9F7A0EFD3E212C274F8A36CD68057580487
SHA-512:	5382838B1091DFD75CA84C261F2697102B269EE712DF6FBE170D83A6CC11B2DFD14F6BD1F2E0A018C99A415E8D8FDA437D0251C77CDC0299391AFB5419737BA8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@.................................u8..O....@.......................`......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......tS..lE...........................................................0..d.........}.....(.......(......s7...}.....sM...}.....sM...}.....sM...}......}......}.....~....}......(......0.............o....sO...}.....{.........,n...}.....{.....o......{.....o......{.....{....oI....{....o....X.{....oK....{....o....Xs....o.......(....}........0..Q..........o....sO...}.....{....,..{.......+....,&..{.....{.....{....oe.....{....o......*....0.............o....sO...}.....{....,..{....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.803426897193995
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Plat#U0103 revizuit#U0103_shrunk.exe
File size:	1'592'832 bytes
MD5:	8eca59816dc6007ae4a40dc09ac5b66f
SHA1:	7ab4088c162ad70f5456dacd1fe34150e22f9e0d
SHA256:	d4f4ad6ea2e448166edde53a24011ddc5c4e870f7c571f9dd5e390e582ca3d33
SHA512:	39b82c25a917169c47a19ec29f0df724274ba4d08e711b0d66e91b131dce4ae41e5df7f9688f1c1d6ceb3138900158736492da7746b76e4cb0c28364ec922043
SSDEEP:	24576:9D7kAAvlv5nN+BqIJomwcwm/V9ABJqbBmosSNutI:9sA22BdJoQwwYOtiSQ
TLSH:	E07512A02259C906D4918F791C32D2F827B56FC9A422E307DFDA7EEFBC1E7119581392
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.................0..............8... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c38ca
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xC91F9674 [Fri Dec 4 06:55:48 2076 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc3875	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc1f60	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc18d0	0xc1a00	d7d20db8b445dea3ddf618e8dd0b26ed	False	0.9379740961910911	data	7.864633377561674	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x5b4	0x600	772d256b13281764708fa34a7f6da0cb	False	0.4225260416666667	data	4.098735699979338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc6000	0xc	0x200	36c2815940979a4d6e6ec0f09c199d9c	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc4090	0x324	data			0.43283582089552236
RT_MANIFEST	0xc43c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	12:51:16
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Imagebase:	0x820000
File size:	1'592'832 bytes
MD5 hash:	8ECA59816DC6007AE4A40DC09AC5B66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2202989415.0000000002CA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2205988648.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2205988648.0000000003DDA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:51:17
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Imagebase:	0xdf0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:51:17
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:51:18
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iKHPXKiqI.exe"
Imagebase:	0xdf0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:51:18
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:51:18
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iKHPXKiqI" /XML "C:\Users\user\AppData\Local\Temp\tmpAD6D.tmp"
Imagebase:	0x540000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:51:18
Start date:	25/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:51:19
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Imagebase:	0x2e0000
File size:	1'592'832 bytes
MD5 hash:	8ECA59816DC6007AE4A40DC09AC5B66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:51:19
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Plat#U0103 revizuit#U0103_shrunk.exe"
Imagebase:	0xcd0000
File size:	1'592'832 bytes
MD5 hash:	8ECA59816DC6007AE4A40DC09AC5B66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:51:19
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Roaming\iKHPXKiqI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\iKHPXKiqI.exe
Imagebase:	0xb80000
File size:	1'592'832 bytes
MD5 hash:	8ECA59816DC6007AE4A40DC09AC5B66F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:51:21
Start date:	25/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:51:23
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1748
Imagebase:	0x20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	163
Total number of Limit Nodes:	12

Executed Functions

Function 012CD371 Relevance: 6.1, APIs: 4, Instructions: 149
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD3FE
GetCurrentThread.KERNEL32 ref: 012CD43B
GetCurrentProcess.KERNEL32 ref: 012CD478
GetCurrentThreadId.KERNEL32 ref: 012CD4D1

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 240c9db3b461032ea5c6b0d0d11c771bfdc02b53cf05ae6efa06b90cedb726b3
Instruction ID: d436f1334da81c8b04114d9c36f7e443611a73b558a26e1f00ba26d45ea51cf5
Opcode Fuzzy Hash: 240c9db3b461032ea5c6b0d0d11c771bfdc02b53cf05ae6efa06b90cedb726b3
Instruction Fuzzy Hash: 586169B090024A9FDB14DFA9D588BDEFBF1EF88304F20855DD209A7361DB34A945CB65

Function 012CD380 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD3FE
GetCurrentThread.KERNEL32 ref: 012CD43B
GetCurrentProcess.KERNEL32 ref: 012CD478
GetCurrentThreadId.KERNEL32 ref: 012CD4D1

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 32e3eedcbf2dacfcfe0fa17aa2787252deafeee82d3606da4cc93438c9c85ca3
Instruction ID: ac707f1afcbb1286b5bc719f94ed65a16790242f40a544c6e6b8e6fec4dddb50
Opcode Fuzzy Hash: 32e3eedcbf2dacfcfe0fa17aa2787252deafeee82d3606da4cc93438c9c85ca3
Instruction Fuzzy Hash: F55147B091034A8FDB14CFA9D588BDEFBF5EF88704F208559E219A73A0D734A844CB65

Function 071676A5 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 071678E6

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 84fb2cf448e6269c41ed3875b863bf50180827d7adc806d2a39145532072e9ab
Instruction ID: 12fec0b917032142a7026d37b018f6ccfb4c216a4fec758564e66cc4b582fa3a
Opcode Fuzzy Hash: 84fb2cf448e6269c41ed3875b863bf50180827d7adc806d2a39145532072e9ab
Instruction Fuzzy Hash: 1EA16FB1D0025ACFEF15CF68C845BEDBBB2BF44714F1481AAE808A7280DB749995CF91

Function 071676B0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 071678E6

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9039b7bd67f14d35022ea53a496e92a4191407d9ac2b000343721a21d1b9bc30
Instruction ID: cb7744d32c2d0f5da22143032ec1548eb660005de8cc5981555ae86c35bbdb21
Opcode Fuzzy Hash: 9039b7bd67f14d35022ea53a496e92a4191407d9ac2b000343721a21d1b9bc30
Instruction Fuzzy Hash: C2916EB1D0021ADFEF15CF68C845BEDBBB2BF44714F1481A9E808A7290DB749995CF91

Function 012C590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59C9

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ddf6c50d5bcfa8cc782a2c5b079ddb5eec423bc7f341d64a32f05b114eeadde8
Instruction ID: 262626710189c34fbbcbd1c6130e2bb4dfd053eabede92dc49d7120c7b247550
Opcode Fuzzy Hash: ddf6c50d5bcfa8cc782a2c5b079ddb5eec423bc7f341d64a32f05b114eeadde8
Instruction Fuzzy Hash: CB41E4B0D00759CFDB24CFAAC884BDDBBB1BF89704F2081A9D509AB251DB756949CF50

Function 012C4514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59C9

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3f1d55ea11897f7bfdda3d3b061a99aadfb131221aaeba916276b8cb6014736b
Instruction ID: 27491248ddd823b7d52cea5a34d80697d8ceb2219001282a149a8ea8827c84fb
Opcode Fuzzy Hash: 3f1d55ea11897f7bfdda3d3b061a99aadfb131221aaeba916276b8cb6014736b
Instruction Fuzzy Hash: EE41D370D1071DCBDB24CFAAC884BDEBBB5BF49704F2081A9D508AB251DB756949CF90

Function 07167421 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 071674B8

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3cd3e66bb3e2afc2b94ee93ef5c00b2ee75ad368a387676693939f9bb968bd73
Instruction ID: 4aaeaf1ac4f626dc0e9a642ef643053cdf8a4f46eca1f1503dce5265971f1c54
Opcode Fuzzy Hash: 3cd3e66bb3e2afc2b94ee93ef5c00b2ee75ad368a387676693939f9bb968bd73
Instruction Fuzzy Hash: BE215CB19003599FDB10CFA9C885BDEBBF5FF48310F108429E918A7241D7789550CBA4

Function 07167428 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 071674B8

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5a76eef22587077fe05b6236506f70ffd4512703a20a0582a5fe65fd10e2be85
Instruction ID: 75a06370c41fc3dbe0c4b90cfe31b9dc24e729245e7e709223d61155038cd739
Opcode Fuzzy Hash: 5a76eef22587077fe05b6236506f70ffd4512703a20a0582a5fe65fd10e2be85
Instruction Fuzzy Hash: 162139B19003599FDB10CFA9C885BEEBBF5FF48314F108429E918A7290D7789950CBA4

Function 07167510 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07167598

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ad9c0fa9ebd4ad98835b695b92bf14ac1594d067facab47fdd57a97afd50cadc
Instruction ID: 927589efbd5da40658546e6c1f9d063e01f5355cf27f20310f10e1eba9d19a9c
Opcode Fuzzy Hash: ad9c0fa9ebd4ad98835b695b92bf14ac1594d067facab47fdd57a97afd50cadc
Instruction Fuzzy Hash: 49214AB18003599FDB10DFAAC881BEEFBF5FF88310F108429E918A7250C7349510DBA4

Function 07167288 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0716730E

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a3fd144abfd8bdf34eaa2f2e20aad2bfc96594b14f33a1ca0dca4abc70b5d9b3
Instruction ID: ce9d8355cab9594b23bbc38ade3b2ce57313b0ecbde3a322f7bac68d3e5c1633
Opcode Fuzzy Hash: a3fd144abfd8bdf34eaa2f2e20aad2bfc96594b14f33a1ca0dca4abc70b5d9b3
Instruction Fuzzy Hash: F9213AB19003099FDB14DFAAC485BEEBBF4FF88314F148429D559A7281CB789954CFA4

Function 07167518 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 07167598

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cbad5df8cd8acb2bba72079ad75ed27a65440e6e5251c4a5e476a2d6c3996c95
Instruction ID: 0a5b018b4c690706625ccec65407275d68b6e288f46e183cba455aea8342eb71
Opcode Fuzzy Hash: cbad5df8cd8acb2bba72079ad75ed27a65440e6e5251c4a5e476a2d6c3996c95
Instruction Fuzzy Hash: 002128B18003599FDB10DFAAC885AEEBBF5FF48310F108429E518A7250C7389550CBA4

Function 07167290 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0716730E

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 016dc53948344390622ca29a9f3866a0c226ab661f47219a93e405e9b8f1e898
Instruction ID: 6e066a9e7f8ef24cdf0d0d1aa825e02547cc9639d3f02e9942c017b311982c74
Opcode Fuzzy Hash: 016dc53948344390622ca29a9f3866a0c226ab661f47219a93e405e9b8f1e898
Instruction Fuzzy Hash: 402129B19003099FDB10DFAAC485BEEBBF4EF88324F148429D559A7280CB789954CFA5

Function 012CD5C2 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD64F

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e91e92d628c69ba5a5601a16a21e7de81da26da7597b98e43226e24f2b052dae
Instruction ID: 88dcae5e7ddfe1d442927b0d31079b3c3deb4fd5d02d7998e76c0ef9160303c8
Opcode Fuzzy Hash: e91e92d628c69ba5a5601a16a21e7de81da26da7597b98e43226e24f2b052dae
Instruction Fuzzy Hash: 242114B5C002499FDB10CFA9D484AEEBFF4FB48320F24811AE918A3310D378A950CFA0

Function 012CD5C8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD64F

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ad2b69936d47ec52cbcfe656468336e93c79989f7bf6e2662c6ecabe90d3e181
Instruction ID: ffb48cbf2aaa8cfb8c6f00b4d882560f8c6f7b13be3bde20f979ed685c906cbc
Opcode Fuzzy Hash: ad2b69936d47ec52cbcfe656468336e93c79989f7bf6e2662c6ecabe90d3e181
Instruction Fuzzy Hash: D621E4B59002499FDB10CF9AD884ADEBBF4FB48310F24811AE918A3350D378A950CFA4

Function 07167361 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 071673D6

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bb7ab05fe32b7658d1cedb5fa38e55600123d4bf52633251dee4e4543192aad5
Instruction ID: 59aec322a741dc4848b473b99e0bb04e89ed8514e4979c66a175029a65d1c7af
Opcode Fuzzy Hash: bb7ab05fe32b7658d1cedb5fa38e55600123d4bf52633251dee4e4543192aad5
Instruction Fuzzy Hash: 931129728003499FDB10DFA9C845BEFBFF5EF88724F24881AE915A7250CB759550CBA4

Function 07167368 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 071673D6

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e27712558a218f5e5d94acff1e5fa738cc8c7332dd1885eda84d09a789a767cf
Instruction ID: f1886e5c8806711ddde2c9d1b0ec3c3bc76c5f93beac3e77dbca43790d26e5fd
Opcode Fuzzy Hash: e27712558a218f5e5d94acff1e5fa738cc8c7332dd1885eda84d09a789a767cf
Instruction Fuzzy Hash: 241137728003499FDB10DFAAC845BEFBBF5EF88324F248819E519A7250CB75A550CFA4

Function 07166DA0 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07166E0A

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e8d1cc16109cb99aad3c4b0e59128cbad49c52172dccf9f66fdd9c091d2e26d2
Instruction ID: 4e51d81b353c1d5f08729c5da9f624bb13459631bca4471fb082492adfa53315
Opcode Fuzzy Hash: e8d1cc16109cb99aad3c4b0e59128cbad49c52172dccf9f66fdd9c091d2e26d2
Instruction Fuzzy Hash: 17116AB19003498FDB14DFAAC445BEFFBF5EF88724F248419D519A7250CB35A940CBA8

Function 07166DA8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 07166E0A

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 09bd5507e6fee0477cd65c7f7605ee36f6afe52068f4f3437e030251c2db7dd7
Instruction ID: f25ead649c60b55eff2c8a79053917b6992a2645d20cadf12687752baeb24ac3
Opcode Fuzzy Hash: 09bd5507e6fee0477cd65c7f7605ee36f6afe52068f4f3437e030251c2db7dd7
Instruction Fuzzy Hash: 731136B19003498FDB20DFAAC445BEFFBF5EF88724F248419D519A7250CB79A940CBA4

Function 0716B1F4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0716BA05

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 14b76fd01edf96f7e858fc7ec1b27ffa8c5b8abce590c5dfa3ab9deaf3a5fc41
Instruction ID: 0598ca8e0b4bbe486ec4e5ba6a855dd7bf798e5a91a7f2a64034b3f26ee21dcb
Opcode Fuzzy Hash: 14b76fd01edf96f7e858fc7ec1b27ffa8c5b8abce590c5dfa3ab9deaf3a5fc41
Instruction Fuzzy Hash: 1311F5B58043499FDB20CF99C488BDEBBF8EB48714F208419E518A7650C375A954CFA5

Function 012CB2D8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 012CB33E

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 75d4521b77e0ae8b736e93bbef575372d5be2af9f74d63a7159b24845029eef1
Instruction ID: 59b6b76572c1ca73f871e4fca8a2693e709b8f350742114ce1f1e8a984c06ff9
Opcode Fuzzy Hash: 75d4521b77e0ae8b736e93bbef575372d5be2af9f74d63a7159b24845029eef1
Instruction Fuzzy Hash: B71110B6C002498FDB14CF9AC444ADEFBF8AB88624F10851ADA29A7210C379A545CFA1

Function 0716B9A0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0716BA05

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3be9f6d1c89887b888c04e0b18582d45d1fa8c72f09edc6cfed53be79f52a43a
Instruction ID: 1875e0a04a45c73bee536de5cb6fb76d9c288cda03225615f130886b96226548
Opcode Fuzzy Hash: 3be9f6d1c89887b888c04e0b18582d45d1fa8c72f09edc6cfed53be79f52a43a
Instruction Fuzzy Hash: 4E1133B58003499FDB20CF9AC885BDEFFF8EB48324F20840AE518A7240C374A554CFA1

Function 011BD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9927feaaf25e02e6f29be26dbce841d43c7eb8de185be7c173e2c3b0c4c230
Instruction ID: 55e4fa1144f8de2d25979a5942fd53d5e41539839fbaa9b3989061af2cac65fa
Opcode Fuzzy Hash: 8b9927feaaf25e02e6f29be26dbce841d43c7eb8de185be7c173e2c3b0c4c230
Instruction Fuzzy Hash: F1210671504204DFDF0DDF54E9C0B96BB65FB88318F20C56DE9094B656C33AE456CBA2

Function 011BD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f9662493bc0d2e50b4bf865f12e1f262f2f79a773662c59d7ea4b9594a0ef4
Instruction ID: 012e772b6fe638927ea59e24529a1d6bf75ea614cd19a3da221c1c2d645a442b
Opcode Fuzzy Hash: 05f9662493bc0d2e50b4bf865f12e1f262f2f79a773662c59d7ea4b9594a0ef4
Instruction Fuzzy Hash: 3D21FF72500244EFDF0DDF58E9C0BA6BF75FB8831CF208569E9090A256C33AD456CAA2

Function 011CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201953718.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11cd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a303953d5b54c91f1d594303947f2bdb70629185cb4c04c8164c5a400e2690e5
Instruction ID: 27d2fc755fe62bf0f44fdd1c002b74fbacbb9c9ddf48ee8a19a5c28951393169
Opcode Fuzzy Hash: a303953d5b54c91f1d594303947f2bdb70629185cb4c04c8164c5a400e2690e5
Instruction Fuzzy Hash: 03212571504200DFDF19DF58E5C0B16BB61FB94B14F20C57DD90A4B242C336D457CAA2

Function 011CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201953718.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11cd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7ba6baf4348ebfd2fd8b9393b4009705130c7cf2aef3ee4c2d620b86f7b5b4
Instruction ID: bddb53400e686e2093f279871b6359ecca1f0e1b93ceb78a54f1a659323340ba
Opcode Fuzzy Hash: 9b7ba6baf4348ebfd2fd8b9393b4009705130c7cf2aef3ee4c2d620b86f7b5b4
Instruction Fuzzy Hash: 09212971504204EFDF09DF94E9C0B26BB66FB94B24F20C57DE9094B252C336D446CBA2

Function 011CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201953718.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11cd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4781bafdbddf0ec87e15c4efc97f4d209e140aec10d6bd4e5a8fdd115fac16b0
Instruction ID: de2c36fceef78e548c8b2da71d91d1975a7f5704499e867c173878f8fbcb67a8
Opcode Fuzzy Hash: 4781bafdbddf0ec87e15c4efc97f4d209e140aec10d6bd4e5a8fdd115fac16b0
Instruction Fuzzy Hash: D92192755083809FCB07CF58D994715BF71EB46214F28C5EAD8498F2A7C33A9816CBA2

Function 011BD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 332bb0157944326d054664e93af5f08b515ca701e6bc78331aca429192c4bfe4
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 3711CD72404240CFCF0ACF44D5C0B96BF61FB84328F2486A9D8090A657C33AE45ACBA2

Function 011BD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: f485c65f29d04b6a299f165ab1deb241bd64e1801b4641c9280e6458e838b2d1
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: B8119D76504284CFCF1ACF54E5C4B56BF71FB84218F2486A9D8490B656C33AD456CBA2

Function 011CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201953718.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11cd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: 6552edad8a959d1848808922a8096854da05f16572ab25bb6f47a7c912c280ec
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 9311BB76504280DFCB06CF54D9C0B15BBA2FB84624F24C6AED8494B296C33AD40ACBA2

Function 011BD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83f23a6452c179c5ded88545606ebdea4724d35c31c37638be4e0761fdf97de
Instruction ID: 6e47350033c29d350655d079feb27567060c5c1c18b78356c9a1ff17a55077fe
Opcode Fuzzy Hash: d83f23a6452c179c5ded88545606ebdea4724d35c31c37638be4e0761fdf97de
Instruction Fuzzy Hash: C801F731004B849AFB1C4EA9DDC4BE7BF98EF4122CF18851AEE084A286C7399441C672

Function 011BD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2201866965.00000000011BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11bd000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c196e71d705d44d3af04ac8b52a24cfed5d81fae791f08888b28406aba875fd
Instruction ID: 27565d687664ba8b83c0e7305c30a539a44328159421fb22636b018fcb67ab75
Opcode Fuzzy Hash: 5c196e71d705d44d3af04ac8b52a24cfed5d81fae791f08888b28406aba875fd
Instruction Fuzzy Hash: FCF0F6710047849EFB148E59DCC4BA2FF98EB81638F18C15AEE0C4F286C3799840CBB1

Non-executed Functions

Function 0716D148 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3864f200100894ccb2e8671b1cdb73fc93924788fa06623e83686cbe99f75bc8
Instruction ID: d441daed8ee6ba903cb494ce8e3a75d90cc61e94edfb1e350e2c80d659869948
Opcode Fuzzy Hash: 3864f200100894ccb2e8671b1cdb73fc93924788fa06623e83686cbe99f75bc8
Instruction Fuzzy Hash: E8D1CCB17016468FDB1ADB7AD464B6AB7F6AF88600F14846DD2868B2D0DB34E901CB91

Function 07166E58 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4715b2bca0d8fbbf880acf095e0e70562b8d75e885d5471d6803d96e58e7c8bd
Instruction ID: 20c05af1b173378c722e4afcbc4e70d761cc45816747c8c2b77eaeba3ecec96f
Opcode Fuzzy Hash: 4715b2bca0d8fbbf880acf095e0e70562b8d75e885d5471d6803d96e58e7c8bd
Instruction Fuzzy Hash: 8DE1E9B4E002198FDB14DFA9C594AAEFBF2BF89305F24815AD414AB356D731AD42CF60

Function 07164510 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ec4e25e8aa05ee9b700f25299c943ad3b61b86fe0146e619b6cccbb34b8f9e
Instruction ID: ae1f0ed1cff77f7bcc6826343a943f82ae495dc21079de695c859c11287afa38
Opcode Fuzzy Hash: c3ec4e25e8aa05ee9b700f25299c943ad3b61b86fe0146e619b6cccbb34b8f9e
Instruction Fuzzy Hash: 0AE10AB4E002598FDB14DFA9C594AAEFBF2BF89305F248169D814AB356D730AD41CF60

Function 07166580 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08d58c1103a3b6107e31a58c0181ae5812d376733564fba42763a2de42973cd
Instruction ID: 5e6e3bf10768e3a4462b7b58f8f5bebc701931488083e6bb99fab25bb87807ea
Opcode Fuzzy Hash: f08d58c1103a3b6107e31a58c0181ae5812d376733564fba42763a2de42973cd
Instruction Fuzzy Hash: 23E1FBB4E002198FDB14DFA9C584AAEFBF6BF89305F248169D814A7356D731AD42CF60

Function 07166148 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff64cc2542ccc971395ac189c3697fd85df133d62c64b1ced23a43152ac559c
Instruction ID: 6cd54938e84e6a26235fc4c4944a09e6a703f5cda1fa6a08430687431cd65ea6
Opcode Fuzzy Hash: cff64cc2542ccc971395ac189c3697fd85df133d62c64b1ced23a43152ac559c
Instruction Fuzzy Hash: 41E1F9B4E002198FDB14DFA9C594AAEFBF2BF89305F248169D418AB356D730AD41CF61

Function 07164948 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6357046bc6f2a77a5f92623ea86642fb93f265188de492e68c20514f66789a70
Instruction ID: 2436e09734e2bbd3eb2c8f3e1a728ccf03d0bf8376a4b06e73695f86a061bee1
Opcode Fuzzy Hash: 6357046bc6f2a77a5f92623ea86642fb93f265188de492e68c20514f66789a70
Instruction Fuzzy Hash: 85E109B4E002598FDB14DFA8C584AAEFBF2BF89305F248169D815AB356D730AD41CF60

Function 012CDEEC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2202282886.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277b1172688f1ced8774c3f77d3ef12bffaa188249b4d99661ece77a9cda83f8
Instruction ID: 50d09475901786503959e882a644af5df7fb85a902931ac87d42eb54d7232890
Opcode Fuzzy Hash: 277b1172688f1ced8774c3f77d3ef12bffaa188249b4d99661ece77a9cda83f8
Instruction Fuzzy Hash: 8AA17032E1020A8FCF15DFB4D9445EEBBB2FF95700B15466EEA05AB265DB31D906CB80

Function 07166E48 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220983487.0000000007160000.00000040.00000800.00020000.00000000.sdmp, Offset: 07160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7160000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceee2c39d19c9966d4aabcf6d97ffa3a522c3239c9cdf996fb7e0aa9c77529dd
Instruction ID: f7eaa252c24e3991d7febd9fe7c7e74ca06fa0b238ee750fb488128b989bb865
Opcode Fuzzy Hash: ceee2c39d19c9966d4aabcf6d97ffa3a522c3239c9cdf996fb7e0aa9c77529dd
Instruction Fuzzy Hash: BD511CB4E002198BDB14CFA9C5946AEFBF2BF89305F24C169D418A7256D7319D42CFA1

Analysis Process: Plat#U0103 revizuit#U0103_shrunk.exePID: 4836, Parent PID: 3380COMMON

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	1249
Total number of Limit Nodes:	13

Executed Functions

Function 00405634 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA,00000000,0040758B), ref: 004056D5
FindNextFileA.KERNEL32(00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA), ref: 00405737
FindClose.KERNEL32(00000000,00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000), ref: 00405741

Strings

*.*, xrefs: 0040567D

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: *.*
API String ID: 3541575487-438819550
Opcode ID: 7c3ae3db1d7091c66810d0afebbe5bbb80646222bcf65a163e226210ed7e34e0
Instruction ID: e0bf5d45d2763b4aada85c2368977cee553341535aa4efecd7ed3e039fa03a50
Opcode Fuzzy Hash: 7c3ae3db1d7091c66810d0afebbe5bbb80646222bcf65a163e226210ed7e34e0
Instruction Fuzzy Hash: 513188B53005006BD705BF26998295B3799DFC5328B60847FB904EB2C7EA7DDC018E99

Function 00405080 Relevance: 4.6, APIs: 3, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004051DB,?,?,?,?,0040523E,00000000,00405291,?,?,00000000,00000000,00000000), ref: 0040513B
FindNextFileA.KERNEL32(00000000,00000010), ref: 0040519B
FindClose.KERNEL32(00000000,00000000,00000010), ref: 004051AB

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 524fcd590759a1fbd4d207714f0cb58143cf8f2903c84afd41d3760fe214a385
Instruction ID: 84585f26add88bff0cc2ce1aee7b2e7e5f9eb71f6f66f1e556af33cdfbb1cecb
Opcode Fuzzy Hash: 524fcd590759a1fbd4d207714f0cb58143cf8f2903c84afd41d3760fe214a385
Instruction Fuzzy Hash: ED415070900508AFDB11EF95C885BDEBBB8EF89305F5044FAE404BB291D7389F459E59

Function 004056A7 Relevance: 4.6, APIs: 3, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA,00000000,0040758B), ref: 004056D5
FindNextFileA.KERNEL32(00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000,004074FA), ref: 00405737
FindClose.KERNEL32(00000000,00000000,?,00408220,?,00000000,00000000,00408220,00000000,00000000,004052D1,00000000,?,00000000,00000001,00000000), ref: 00405741

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 7e704a9b868fdf1e88b7c0ef0153828458dabf46e2b7cce886aa46cd4968a9f2
Instruction ID: f2b03bfa0ad8d059d80b67f6c6517dce38b4ab09ecbfd790616c6b691a452e24
Opcode Fuzzy Hash: 7e704a9b868fdf1e88b7c0ef0153828458dabf46e2b7cce886aa46cd4968a9f2
Instruction Fuzzy Hash: 0E1181B53005006BD605BB269D8296B3759DBC5328B10843FBA04EB2C7DA3DCC029A99

Function 00406D40 Relevance: 3.1, APIs: 2, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalDriveStringsA.KERNEL32(00000097,?), ref: 00406D70
GetDriveTypeA.KERNEL32(00000000), ref: 00406D89

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Drive$LogicalStringsType
String ID:
API String ID: 1630765265-0
Opcode ID: e173af02ca9d9f3ac33bd7cae86aa4c8f38faec1d5ba2bccd9283cb2c0ba3d05
Instruction ID: e1e1b0806745e30ff5eb453561950d2c3ef676df74625b4c39c06a75345551cd
Opcode Fuzzy Hash: e173af02ca9d9f3ac33bd7cae86aa4c8f38faec1d5ba2bccd9283cb2c0ba3d05
Instruction Fuzzy Hash: 301159725181089EE720BE759C52BAA7FADDF45304F4644F7AA0DB32C3D9384D128A28

Function 00404F6C Relevance: 3.0, APIs: 2, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(?,?,0040818B,00000000,00408220), ref: 00404F74
FindClose.KERNEL32(00000000,?,?,0040818B,00000000,00408220), ref: 00404F7E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 66901251027beccf77baa5ce98e67b536316a538da170c98b5b2277659282e4c
Instruction ID: 35bd28bbec0286cbaf15e580cccf41787655d5f9f594f83c1a320a5651e29ebc
Opcode Fuzzy Hash: 66901251027beccf77baa5ce98e67b536316a538da170c98b5b2277659282e4c
Instruction Fuzzy Hash: B8C08CE480010023C80033AA8C06A27204CBAC0358F88092A7BA8F72C3C93E891040AE

Function 004071D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00407318
SetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 0040732A

Part of subcall function 00404B68: CreateFileA.KERNEL32(00408220,80000301,80000301,00000000,80000301,80000301,00000000,00404CB4,00000000,00404CE6), ref: 00404B88

SetFileAttributesA.KERNEL32(00000000,00000000,00000000), ref: 00407461

Part of subcall function 00404BC4: ReadFile.KERNEL32(00000000,0040A698,?,?,00000000,00000000,?,00404CC7,00000000,00404CE6), ref: 00404BCF

Part of subcall function 00404BB4: SetFilePointer.KERNEL32(00000000,000003E8,00000000,?,00407179,00000000,004071BF,?,00000000), ref: 00404BBC

Part of subcall function 00404BE0: WriteFile.KERNEL32(00000000,0040A698,0000A200,?,00000000,?,?,0040742B), ref: 00404BEA

Strings

M, xrefs: 004073B6
Z, xrefs: 004073C3
\PROGRA~1\, xrefs: 004072C8

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: File$Attributes$CreatePointerReadWrite
String ID: M$Z$\PROGRA~1\
API String ID: 997383822-1237680573
Opcode ID: 3325f7f34ba1cab3d3c53affcca57471aa0c7a6c0db11dbc350d39af7ef534dd
Instruction ID: 377d96c4788612fdddee84976f6eb16641268004b287eb3b442383de46351668
Opcode Fuzzy Hash: 3325f7f34ba1cab3d3c53affcca57471aa0c7a6c0db11dbc350d39af7ef534dd
Instruction Fuzzy Hash: 71514370B042045BDB10FB6ACC82A8EB7A59F85308F1085BBB504B73D3DA7DEF454A5A

Function 004078A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004049D0: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000000,00404ADA,?,?,?,?,?,004070F9,00000000,00407126,?,00000000), ref: 00404A09

SetCurrentDirectoryA.KERNEL32(00000000), ref: 004078D0

Part of subcall function 00405008: GetTempPathA.KERNEL32(00000105,?,00000000,00405072,?,00000000), ref: 00405036

Part of subcall function 004049D0: GetCommandLineA.KERNEL32(00000000,00404ADA,?,?,?,?,?,004070F9,00000000,00407126,?,00000000,?,00408179,00000000,00408220), ref: 00404A23

ShellExecuteA.SHELL32(00400000,open,00000000,?,?,?), ref: 00407969

Strings

open, xrefs: 0040795E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CommandCurrentDirectoryExecuteFileLineModuleNamePathShellTemp
String ID: open
API String ID: 2622400689-2758837156
Opcode ID: fab5c3a15cb1cae7a61865492dfe33df0841a2aab3c5e5074238c8010eb0912a
Instruction ID: bc53e8da7d6e16968f2b3cdc64b9b09c5d4ffb8ac025ca0eed744acd73de400d
Opcode Fuzzy Hash: fab5c3a15cb1cae7a61865492dfe33df0841a2aab3c5e5074238c8010eb0912a
Instruction Fuzzy Hash: 83113070B107198ADB10FB79CC41A8DB779FF85308F0085F6B108BB192D67E9E858E5A

Function 00401304 Relevance: 3.8, APIs: 3, Instructions: 45
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0040A5E4,?,?,?,00401670), ref: 00401322
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0040A5E4,?,?,?,00401670), ref: 00401347
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0040A5E4,?,?,?,00401670), ref: 0040136D

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: e17c01c161f917c304470fc5bdd154c62ee178939f0222dfd3bc6fa3e96f4c6e
Instruction ID: 68b8f7d00e12c5576b1b617c6ecf0cca3c834072eeb02b8dde9827deaaa3e0cb
Opcode Fuzzy Hash: e17c01c161f917c304470fc5bdd154c62ee178939f0222dfd3bc6fa3e96f4c6e
Instruction Fuzzy Hash: 22F0AFB1641320AAFB316A6A8C86F433AD8DB45794F104076BB48FF7DAD6B95800866C

Function 00402FA4 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: ab20704e86a3c794a86d4a60a2f3f790aa59cc74fa6ee8820611fb12759a24f3
Instruction ID: 25a4abd2e023ddac5d936c147021e49c52e2d721a9332ed2c08f3b56dfe932ed
Opcode Fuzzy Hash: ab20704e86a3c794a86d4a60a2f3f790aa59cc74fa6ee8820611fb12759a24f3
Instruction Fuzzy Hash: 77218E709012018BEB20AF65C6887537AE9AF44355F24447BD844A72D6D7BCCDC0DBAA

Function 00402F9C Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: e87d145c5cbc11a3b1b75d0fafe500ddba1f5edf94dcaa2e3019682a10fbe1e7
Instruction ID: 4b2d42af59d3b1d8e88fe9e31da9e43e6ca94f4fbd885f656fef1c50f2c896c1
Opcode Fuzzy Hash: e87d145c5cbc11a3b1b75d0fafe500ddba1f5edf94dcaa2e3019682a10fbe1e7
Instruction Fuzzy Hash: 1C216D709013418BEB21AF65C6883537BA9AF45315F2444BBD844A72DAD7BCCDC4CBAA

Function 00402FA0 Relevance: 3.1, APIs: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00400000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 00403029
ExitProcess.KERNEL32(00000000,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000,00402460), ref: 0040305E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 13075f1f07cc84eb7334053c3716d9a8ce4deda8e863971867078cc8782122a9
Instruction ID: 1b03414f8cc1a74ea96aefb4ecc0c7aba41324da9db28816bc81a4039e10204c
Opcode Fuzzy Hash: 13075f1f07cc84eb7334053c3716d9a8ce4deda8e863971867078cc8782122a9
Instruction Fuzzy Hash: D8217F709013418BEB20AF65C6883537BA8AF44315F24447BD844A62DAD3BCCDC0CB9E

Function 0040759C Relevance: 3.1, APIs: 2, Instructions: 62
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404018: CreateMutexA.KERNEL32(00408220,00408206,00408205,?,004075E3,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000), ref: 0040402E

GetLastError.KERNEL32(00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000,?,00408205,00000000,00408220), ref: 004075E5

Part of subcall function 00406D40: GetLogicalDriveStringsA.KERNEL32(00000097,?), ref: 00406D70

ReleaseMutex.KERNEL32(00000000,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000,?,00408205,00000000,00408220), ref: 0040763C

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Mutex$CreateDriveErrorLastLogicalReleaseStrings
String ID:
API String ID: 676290295-0
Opcode ID: 0b1858c04844e63bceb42a1c2aae0906aae676d4158ef1d644554abea356ae6a
Instruction ID: a50fa674edadcb4b051b0a96f5935ee5b8f91fbc0aee7086ed6abe5ddad9c237
Opcode Fuzzy Hash: 0b1858c04844e63bceb42a1c2aae0906aae676d4158ef1d644554abea356ae6a
Instruction Fuzzy Hash: A2110A306446086BD710BBA6CC42B5E7B6CCB81714F5004BBFA017B3C3CA3DAD04816E

Function 004012A0 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004015A9), ref: 004012CF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004015A9), ref: 004012F6

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 677c0526faf000c49acf14ba7c711909bb3502ece2a084bb3d0e397bba4ce0ca
Instruction ID: 90e8f67b1060bd1251f945ff82b9078c1ba764c12e4cd0c6011b14969f372c3f
Opcode Fuzzy Hash: 677c0526faf000c49acf14ba7c711909bb3502ece2a084bb3d0e397bba4ce0ca
Instruction Fuzzy Hash: 97F02773B006205BEB206A6A4D81B4369C59F59B90F1400BAFB4CFF3D9DA798C0043A9

Function 004079A0 Relevance: 1.6, APIs: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F90: GetWindowsDirectoryA.KERNEL32(?,00000105,00000000,00404FFA,?,?,?,00407EB6,00000000,00408020,?,?,00000000,00000000,?,0040819C), ref: 00404FBE

Part of subcall function 00404B9C: GetFileAttributesA.KERNEL32(00000000,00407EDD,00000000,00408020,?,?,00000000,00000000,?,0040819C,00000000,00408220), ref: 00404BA2

DeleteFileA.KERNEL32(00000000,00000000,00407AC4,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00408200,00000000,00408220), ref: 00407A0D

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: File$AttributesDeleteDirectoryWindows
String ID:
API String ID: 3550186980-0
Opcode ID: 2b38db87221643786ed3eba0d04c85d5b230a23d247254b4ccd5576931fb6927
Instruction ID: 69b580403c23d9cc841dfa7c227de2d2e2536c961132663fd28ad6461d03daee
Opcode Fuzzy Hash: 2b38db87221643786ed3eba0d04c85d5b230a23d247254b4ccd5576931fb6927
Instruction Fuzzy Hash: 91212F70B04109ABDB04FAA5C85279F7B69EB85304F50847EA501BB3C2DF3CEE05976A

Function 00405200 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405080: FindFirstFileA.KERNEL32(00000000,?,00000000,004051DB,?,?,?,?,0040523E,00000000,00405291,?,?,00000000,00000000,00000000), ref: 0040513B
Part of subcall function 00405080: FindClose.KERNEL32(00000000,00000000,00000010), ref: 004051AB

DeleteFileA.KERNEL32(00000000,00000000,00405291,?,?,00000000,00000000,00000000,00000000,?,00407736,?,?,?,00000000,0040798C), ref: 0040525F

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDeleteFirst
String ID:
API String ID: 3969940835-0
Opcode ID: 238fab5c7ccdf0ad421be398039805a42527f4fe23ed0a78c41523e31c8e5186
Instruction ID: 7b79426e1ef5d484ccb35ed710867a40efa654d54104ddfac4c0367765dd07f6
Opcode Fuzzy Hash: 238fab5c7ccdf0ad421be398039805a42527f4fe23ed0a78c41523e31c8e5186
Instruction Fuzzy Hash: BF01A174604608AFDB04EBA1CC529AF73ACEF45304F5048BEF901B3281E678AE059E68

Function 0040578C Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,00000000,00000000,00000001,00000000,00000001,?,?,00000000,00407AA2,00000000,00407AC4,?,?,00000000,00000000), ref: 004057B7

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8fc1d0df2935156870a761a9e005f3ed3dcf16a2c3928d3d316ee70feded526d
Instruction ID: 82ccab74ab13a132c34841d8e2f7e51fc97cb509c9d1c97b6ea97491bda523d5
Opcode Fuzzy Hash: 8fc1d0df2935156870a761a9e005f3ed3dcf16a2c3928d3d316ee70feded526d
Instruction Fuzzy Hash: 17E04F5131061166E511256A0CC1A7B0D9D8B44A56F04043BB904EF2C3D968CD0321A9

Function 00406CA8 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004064E4: DestroyCursor.USER32(00000000), ref: 004064F3

ExtractIconA.SHELL32(00400000,00000000,00000000), ref: 00406CC7

Part of subcall function 00406520: GetIconInfo.USER32(?), ref: 00406540
Part of subcall function 00406520: GetObjectA.GDI32(?,00000018,?), ref: 00406551
Part of subcall function 00406520: DeleteObject.GDI32(?), ref: 00406566
Part of subcall function 00406520: DeleteObject.GDI32(?), ref: 00406574

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Object$DeleteIcon$CursorDestroyExtractInfo
String ID:
API String ID: 2619871307-0
Opcode ID: 12884ea93cf9522b21f7407772e5477059801f61b384028fea43c793ebaab2fd
Instruction ID: 3dd68c7f1dd4f5608f9b9662a0ba171f3b5b53225b24c93893625578eb0e5390
Opcode Fuzzy Hash: 12884ea93cf9522b21f7407772e5477059801f61b384028fea43c793ebaab2fd
Instruction Fuzzy Hash: 32D05E767002202BC321B6BF2CC181B8ADDCACA269316453FB109F7293C97DCC12126D

Function 0040575C Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000000,00000000,00000000,0002001F,?,?,?,?,00407A60,00000000,00407AC4,?,?,00000000,00000000,00000000), ref: 00405774

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 069e22fb027c4afddc5b5976f6d816458c7a75ea1a42f49c021bc25e4846d371
Instruction ID: 3a3203429d587fd7172cf24d4e67cc15a32e0ac6e1cd073cd859d0159acdf75a
Opcode Fuzzy Hash: 069e22fb027c4afddc5b5976f6d816458c7a75ea1a42f49c021bc25e4846d371
Instruction Fuzzy Hash: 7AD05EA13046107EE210B62A5C81FBB6ACCCB487A6F00053AF948E6283D225CD0052A5

Function 00404F34 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(00000000,?,00000104), ref: 00404F52

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: abb4d550bda5475c99f0f2794432747b4105fc54e92a365e7278d0c8b630ade4
Instruction ID: 14e814bc68ad69d6c3dbd45ca29a6777f0e45ac5a2bbd03733d3eefc14da3dab
Opcode Fuzzy Hash: abb4d550bda5475c99f0f2794432747b4105fc54e92a365e7278d0c8b630ade4
Instruction Fuzzy Hash: C9D05EE1B0021027D200B66D1CC2A9BA6CC4B88729F14413A7758EB2D2E9798E1402D9

Function 00404B68 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00408220,80000301,80000301,00000000,80000301,80000301,00000000,00404CB4,00000000,00404CE6), ref: 00404B88

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eea2c6d1fddd31fd331317c09d3e296815bd40418f117fca415fb9ec57fe0382
Instruction ID: ecc9e2cd6cddaadd7fb33e9927afed1fcbe410aa9616ae81c498ff4a473f225f
Opcode Fuzzy Hash: eea2c6d1fddd31fd331317c09d3e296815bd40418f117fca415fb9ec57fe0382
Instruction Fuzzy Hash: F9C012E15641113EFA0C22587C37FBB128D83D4714C90962EB206A77D1C458280041AC

Function 00404BC4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,0040A698,?,?,00000000,00000000,?,00404CC7,00000000,00404CE6), ref: 00404BCF

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 07c637d247b66d3b0a9c7b3941f0c52b1614d40a6673a640bb3ecb2c78beae31
Instruction ID: 3ae4d4c2ce5489376b9a0e409b07906e0c93d400668ceedc4e43a286d92feaa2
Opcode Fuzzy Hash: 07c637d247b66d3b0a9c7b3941f0c52b1614d40a6673a640bb3ecb2c78beae31
Instruction Fuzzy Hash: DEC04CA12582083AF51061A29C16F23355CC781799F12456AB704E51D1F096F81000A9

Function 00404BE0 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,0040A698,0000A200,?,00000000,?,?,0040742B), ref: 00404BEA

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 83a29245ac6b35b996f4ce35e430c7ef2da10dd3d2364903d861bf1a917f60bf
Instruction ID: cd8d274a544879f86d75f83ceab2a9824fbef203ff2d66308718860d554d7d3d
Opcode Fuzzy Hash: 83a29245ac6b35b996f4ce35e430c7ef2da10dd3d2364903d861bf1a917f60bf
Instruction Fuzzy Hash: 4EC04CA11582083AF51051A7AC06F233A5CC781698F114436BB08E1581F456F8011079

Function 00404018 Relevance: 1.5, APIs: 1, Instructions: 14synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00408220,00408206,00408205,?,004075E3,00000000,00000000,004091C8,00000000,0040765C,?,?,?,?,00000000,00000000), ref: 0040402E

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction ID: 31d529539147b31f913da60fb79b32c9d72b995d2910e43382fd7a33128a04fb
Opcode Fuzzy Hash: 21e0619b74412fae9514185c35c6bd95fbb7b52f213a822672066e7264c0ded7
Instruction Fuzzy Hash: 8AC01273150248ABC700EEA9DC05D9B33DC5758609B008825B618D7100C139E5909B64

Function 00404EB0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00404E7A,00000000,00404E9F,?,?,00000000,00000000,00000000,00000000,?,004076D4,00000000,0040798C), ref: 00404EBD

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 386e56552f8266bde2ccc84166bcc5ed92a1d83404cd9177086d901dfc68956f
Instruction ID: 54881843ca4f04485c80971131db710ee83c2c1d717b1f588eca7c15a420d4f4
Opcode Fuzzy Hash: 386e56552f8266bde2ccc84166bcc5ed92a1d83404cd9177086d901dfc68956f
Instruction Fuzzy Hash: 71B092927542401AEA003ABA2CC2B2A098C974460EF10093AF206EA283D47AC9050014

Function 00404B9C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00407EDD,00000000,00408020,?,?,00000000,00000000,?,0040819C,00000000,00408220), ref: 00404BA2

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8025a4ee7f9a6a5e32ffee1429e28f2d9b7c921bde027667d06e53d93cfb3014
Instruction ID: b116303671e024f583cda4c1147e2dbfbac77b887c659148fe5224e5fd1b100a
Opcode Fuzzy Hash: 8025a4ee7f9a6a5e32ffee1429e28f2d9b7c921bde027667d06e53d93cfb3014
Instruction Fuzzy Hash: 65A012C682120114CC1071F1220375A0144E4C02CC38448A62350B00C2C83CE501001D

Function 00404CF8 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00404E3F,00000000,00404E9F,?,?,00000000,00000000,00000000,00000000,?,004076D4,00000000,0040798C,?,0000144A), ref: 00404CF9

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1dfe280059354c2d3b00f373a1eb4cf2bc4e4ec1fc5d2a6436fb04a1a0edb6b0
Instruction ID: 74a4a45bf51c4893599122cbb6035ce0c32fa2704c567f2e8b32d3ffb48088ed
Opcode Fuzzy Hash: 1dfe280059354c2d3b00f373a1eb4cf2bc4e4ec1fc5d2a6436fb04a1a0edb6b0
Instruction Fuzzy Hash: 66A002C686650749DD1022E56607AAE0249FCD12D8B9D5D665391FA1C2C93CA992902E

Function 00404BB4 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,000003E8,00000000,?,00407179,00000000,004071BF,?,00000000), ref: 00404BBC

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7cf7d094e1152e8ce2a36ef2ea1d814d027d71488bb8302382125c90c8a75838
Instruction ID: 68b303876a78b47fa373b2f01407b4ce5b79aa50a67d4c8f5d0a49418ed6adba
Opcode Fuzzy Hash: 7cf7d094e1152e8ce2a36ef2ea1d814d027d71488bb8302382125c90c8a75838
Instruction Fuzzy Hash: 69A002D85902203AF8182363AC5FF37105C97C0B55FD0855E7351754C164EC6A241039

Function 0040137C Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004013E0

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b3f1c77c9a82428dc6568712acca71c6867497a5d50ad774a7e16de62942a854
Instruction ID: f327295f0dbb7d02968337953404c96d08b75f0734ec548ae522820371e35f3d
Opcode Fuzzy Hash: b3f1c77c9a82428dc6568712acca71c6867497a5d50ad774a7e16de62942a854
Instruction Fuzzy Hash: CB21E570608741AFD710DF19C880A5FBBE0EB85720F14C96AE8989B7A5D378E841DB5A

Function 004014C8 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,00000000,00004003,0040172F), ref: 00401522

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 366ed2c7ca182d6b4595971b05bf8940527af6e3e06c25c2a4c3263d2ce5472b
Instruction ID: c2f9954cc8299db513f2c37eb2bc070e0fd4fafed15322d1c8bcd52f3136bf23
Opcode Fuzzy Hash: 366ed2c7ca182d6b4595971b05bf8940527af6e3e06c25c2a4c3263d2ce5472b
Instruction Fuzzy Hash: E501F7736043006FC3109E28DDC092A77A4EBC5324F15053EDA85AB3A1D73AAC0587A8

Function 004010FC Relevance: 1.3, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,0040A5E4,0040115F,?,?,004011FE,?,?,?,00000000,00004003,0040173F), ref: 0040110F

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: e704011d59091ef39bab40cf9f47e6c61213b0619fd5946ce42960c9093c2bc6
Instruction ID: b1887d2a642e31e89738e15f0efcd0894f0d6c0890685fd23c4a2ce375bb14e7
Opcode Fuzzy Hash: e704011d59091ef39bab40cf9f47e6c61213b0619fd5946ce42960c9093c2bc6
Instruction Fuzzy Hash: A9F082757012028FD728CF29DC81655B3E2FB9D315F20807EE285EB3A0E7358C518B48

Function 00404B90 Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00404CD0,00000000,00404CE6), ref: 00404B91

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ef71f196dd3e8bd5321f6bf3e93503307ae4868d30203b0da39ae7c2a7e1010a
Instruction ID: f540dd3953723152695a7cfd94b4b723d26dbf970bde7b3718d3bc06e0259ed2
Opcode Fuzzy Hash: ef71f196dd3e8bd5321f6bf3e93503307ae4868d30203b0da39ae7c2a7e1010a
Instruction Fuzzy Hash:

Function 00407678 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ffbce9ad41ee186f7f6225872613ed6a0bd1f14c14150b1f77e3a925856f57
Instruction ID: bad4d56910de55197467fd61e6ec6c56c875cf63360af75c5594bc2395637eb8
Opcode Fuzzy Hash: e2ffbce9ad41ee186f7f6225872613ed6a0bd1f14c14150b1f77e3a925856f57
Instruction Fuzzy Hash: 42514170B002199BDF10EB69CC51A9DB7B5EB46308F1084FAA404772D1DA3DAF458E5A

Function 004080E4 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileFindModule$CloseFirstHandleName
String ID:
API String ID: 2572062711-0
Opcode ID: 6d70fba820807f475e386924a9e2af15878d2dd69a0bc15187a92624e301fe42
Instruction ID: ce7274d5a0203330cd45a7cf6d0e011d083bf460e717dce8afa0a39e5ced3773
Opcode Fuzzy Hash: 6d70fba820807f475e386924a9e2af15878d2dd69a0bc15187a92624e301fe42
Instruction Fuzzy Hash: D4211E70B142054BEB40B7B6C95279F76A5DB88304F50493FE544BB3C2DA3DAD0586AE

Function 004074B4 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7c348ce77f50c17542cebb3b0538e5ca6a1de9245a361f45dd7a6b294aa538
Instruction ID: 101897594dce54360dc52a275b3a014dbc9cabf376d6d76c5a5bbcf91f550c41
Opcode Fuzzy Hash: fd7c348ce77f50c17542cebb3b0538e5ca6a1de9245a361f45dd7a6b294aa538
Instruction Fuzzy Hash: 53218830B045096FCB04EF65CC8299F77A9EB84304B60447FB801B77C2DA78EE058B55

Function 00404DE0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 60dcf029e418bb4de6c98b25837b89894300ef75002f4660ff180e9b0e990edb
Instruction ID: 1dfd328e9d81c806f2c03a8771cfa584465e3ed9e3942cc4fd01b0b075e0960a
Opcode Fuzzy Hash: 60dcf029e418bb4de6c98b25837b89894300ef75002f4660ff180e9b0e990edb
Instruction Fuzzy Hash: 712106B4600209EFDF00EFA5C94299EB7B8FF85304B5045BABA04B72D1D778AF04D658

Function 00406E94 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: LocalPathTempTime
String ID:
API String ID: 2118298429-0
Opcode ID: be31c71bef31dcf0d495f0e1e2d88fef08ea193925f7f09ef08642d0a6e869a3
Instruction ID: 68f96da1d51e9565b10b5108b435a8bc67f0bfec9723d228dfcbae9d3fbb17ab
Opcode Fuzzy Hash: be31c71bef31dcf0d495f0e1e2d88fef08ea193925f7f09ef08642d0a6e869a3
Instruction Fuzzy Hash: 4A0175709042099FDB00EFA5DC5159FB7BDFB45300F52857BE414F36C5DB38AA148A69

Function 00406E0C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: LocalPathTempTime
String ID:
API String ID: 2118298429-0
Opcode ID: 9ebf2497efcd088985c7c12593c49bcd6c1476062836a5d8264ce089f9aca9e5
Instruction ID: 12372a3f9371d2085618e996b35078a817f0987df7eb07415f7737174ae74002
Opcode Fuzzy Hash: 9ebf2497efcd088985c7c12593c49bcd6c1476062836a5d8264ce089f9aca9e5
Instruction Fuzzy Hash: 650167759006089FDB00EFA5C85269EBBB8EB44304F51897BA414E36C1DB389A14CA99

Function 004070DC Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 2f22c95ce754a069faf3e5d71a99af3f29d8e87556c895829c3b73c460f21ff1
Instruction ID: dbacf8f9bda0d2f3624fed2e55e69454661720eb62c3ca271fb24a4619442e3b
Opcode Fuzzy Hash: 2f22c95ce754a069faf3e5d71a99af3f29d8e87556c895829c3b73c460f21ff1
Instruction Fuzzy Hash: 32E09270708304AFE701EB72DC13A19B7ACD78A704FA24877E600AA6D1DA7DAE118519

Function 004052AC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 4f493d9307b3d4b817a7e836544abeb962cbb198da26cb643227803e88156b29
Instruction ID: b59b8e1bf290491f0b5bd01f3f1f1884d5f58955f35eb0aac9512fedb03d6d3a
Opcode Fuzzy Hash: 4f493d9307b3d4b817a7e836544abeb962cbb198da26cb643227803e88156b29
Instruction Fuzzy Hash: 70D0A76230111417870065BF2C84C2BF3CDCBCD565391413AB208D7341DD35AC0742B8

Non-executed Functions

Function 00403D7D Relevance: 9.0, APIs: 6, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00402808: GetKeyboardType.USER32(00000000), ref: 0040280D
Part of subcall function 00402808: GetKeyboardType.USER32(00000001), ref: 00402819

GetCommandLineA.KERNEL32 ref: 00403DE3
GetVersion.KERNEL32 ref: 00403DF7
GetVersion.KERNEL32 ref: 00403E08
GetCurrentThreadId.KERNEL32 ref: 00403E44

Part of subcall function 00402838: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040285A
Part of subcall function 00402838: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040288D
Part of subcall function 00402838: RegCloseKey.ADVAPI32(?,004028B0,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004028A3

GetThreadLocale.KERNEL32 ref: 00403E24

Part of subcall function 00403CB4: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00403D1A), ref: 00403CDA

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID:
API String ID: 3734044017-0
Opcode ID: 0632ebee869107818fc617476dd3b707cbc1511b343300be66bfea40396029a6
Instruction ID: 4e42c8c4ff7c9e6347351f52ed3844a5f6dcad7449c2d11acc3bcf8107044070
Opcode Fuzzy Hash: 0632ebee869107818fc617476dd3b707cbc1511b343300be66bfea40396029a6
Instruction Fuzzy Hash: 7B016DB180438599E710BF72AA4A3193E64AB11309F10853FA080BA3F3D77D06989B6F

Function 00403CB4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00403D1A), ref: 00403CDA

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f7943df5f697ff604979ede478dc829ce2ae39317294e6d377f4d43c8f2bc4e7
Instruction ID: 6d3425cb13dc4e10e5c99e835ecbf0d9b5a709cf75aacf138b47c3a7ed30a7d1
Opcode Fuzzy Hash: f7943df5f697ff604979ede478dc829ce2ae39317294e6d377f4d43c8f2bc4e7
Instruction Fuzzy Hash: DDF0C830904209AFEB04DFA2CC42ADEF77EFB88714F10887AA110675C0EBB82B04C648

Function 004057D8 Relevance: 1.5, APIs: 1, Instructions: 10timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004057E0

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 7c7103a78b60b1e57ed44af7b7ea6f275b95f35198deba2e3da0b3ebacb4dc04
Instruction ID: b0c73d71d4f1c0cd7d69287b67f47955239943ce197f7fb6ed2486fd72728d1c
Opcode Fuzzy Hash: 7c7103a78b60b1e57ed44af7b7ea6f275b95f35198deba2e3da0b3ebacb4dc04
Instruction Fuzzy Hash: F2C08C6280490553CA00B724CC0684EB69CAEC0210FC0C9BEA9C8A21F1EB39C72A8787

Function 0040627C Relevance: 25.7, APIs: 17, Instructions: 183windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018), ref: 004062C2
CreateCompatibleDC.GDI32(00000000), ref: 004062D7
GetDC.USER32(00000000), ref: 004062E9
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004062F6
ReleaseDC.USER32(00000000,00000000), ref: 004062FE
SelectObject.GDI32(00000000), ref: 00406307
CreateSolidBrush.GDI32(00000000), ref: 00406320
FillRect.USER32(?,?,00000000), ref: 0040632E
DeleteObject.GDI32(00000000), ref: 00406333
SelectObject.GDI32(?), ref: 00406344
SetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0040635B
SelectObject.GDI32(00000000,?), ref: 00406371
GetDIBits.GDI32(?,00000000,00000000,?,00000000,?,00000000), ref: 004063E4
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 0040640F
SelectObject.GDI32(?,00000000), ref: 0040641D
SelectObject.GDI32(?,00000000), ref: 00406435
DeleteDC.GDI32 ref: 00406465

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Object$Select$Create$BitsCompatibleDelete$BitmapBrushFillRectReleaseSectionSolid
String ID:
API String ID: 3348884779-0
Opcode ID: becf70a625b9a30146d272fd5bbb048cf5534f59ad9606d33f7b6e5dd878182e
Instruction ID: a9e686f7fc2ed882930d99cc47d1dbb646c45f2a2f24960de351e96cc7451368
Opcode Fuzzy Hash: becf70a625b9a30146d272fd5bbb048cf5534f59ad9606d33f7b6e5dd878182e
Instruction Fuzzy Hash: AE5195B1204200AFDB05AF65CC86F2B3AA9EF94314F1145BEBA45BF1D7C639DC618798

Function 00406218 Relevance: 16.6, APIs: 11, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba240bc75a83fef15349861cf5e056242dc807168d5e068429e02be0b81ae198
Instruction ID: ab27ac02cf2ee968932468d3d4c2958694adf508222a5702edd9c4bd71c6629c
Opcode Fuzzy Hash: ba240bc75a83fef15349861cf5e056242dc807168d5e068429e02be0b81ae198
Instruction Fuzzy Hash: A73184B12002006FDB04BF658C85F2A3A69AFD4314F5244BEBA06BF2D7D639DCA1975C

Function 00406638 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 409COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 00406700
GetObjectA.GDI32(00000000,00000018,?), ref: 0040671F
GetObjectA.GDI32(00000000,00000018,?), ref: 00406789
GetObjectA.GDI32(?,00000018,?), ref: 004068BE
CopyImage.USER32(00000000,00000000,?,?,00000000), ref: 00406977
CopyImage.USER32(?,00000000,?,?,00000000), ref: 004069FE
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00406752

Part of subcall function 004061E0: GetObjectA.GDI32(00000000,00000018), ref: 004061F2

Part of subcall function 00406154: GetDC.USER32(00000000), ref: 00406177
Part of subcall function 00406154: CreateDIBSection.GDI32(00000000,?,00000000,00000041,00000000,00000000), ref: 00406192
Part of subcall function 00406154: ReleaseDC.USER32(00000000,00000000), ref: 0040619D

CopyImage.USER32(?,00000000,?,?,00000000), ref: 00406A93

Strings

(, xrefs: 004068DE

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Object$CopyImage$CreateReleaseSection
String ID: (
API String ID: 1382064897-3887548279
Opcode ID: b87f20a83175f2906a7489a7fbf9040407ae31a25fa5465e07b5007ee3421fdb
Instruction ID: 8b23a46e2d3205504fa6020bfc4f244d26e515b74d7163ba5290a0ebff7405a2
Opcode Fuzzy Hash: b87f20a83175f2906a7489a7fbf9040407ae31a25fa5465e07b5007ee3421fdb
Instruction Fuzzy Hash: 37E16170A002189BDB10EBA9D885AAEB7F5AF49304F11807BF405FB3C1DA3D9D55CB69

Function 00402F18 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000,00000000), ref: 00402F51
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000,?,00000001,00403086,004024E3,0040252B,00000000), ref: 00402F57
GetStdHandle.KERNEL32(000000F5,00402FA0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000), ref: 00402F6C
WriteFile.KERNEL32(00000000,000000F5,00402FA0,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,00402FE6,?,00000000), ref: 00402F72
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00402F90

Strings

Error, xrefs: 00402F84
Runtime error at 00000000, xrefs: 00402F4A, 00402F89

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 3a9f92cc1793bd906a324f4b2820f365d342c083d99e01712e2be0f2c1988d27
Instruction ID: 6c3b7e42d3c7ef80f9ab9078d96d43441ff44d86987642024caec186a117226f
Opcode Fuzzy Hash: 3a9f92cc1793bd906a324f4b2820f365d342c083d99e01712e2be0f2c1988d27
Instruction Fuzzy Hash: 5AF0B47168438538E630A3609F0EF5A226C4744B99F20467FB660781F6C7FC58C4921E

Function 0040184C Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040A5B4,00000000,00401922), ref: 00401879
LocalFree.KERNEL32(00000000,00000000,00401922), ref: 0040188B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401922), ref: 004018AA
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401922), ref: 004018E9
RtlLeaveCriticalSection.KERNEL32(0040A5B4,00401929,00000000,00000000,00401922), ref: 00401912
RtlDeleteCriticalSection.KERNEL32(0040A5B4,00401929,00000000,00000000,00401922), ref: 0040191C

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 02c6954cbcb64e56162da80bdf3b7417e68cd6eb195c9a2433517f3198adb53e
Instruction ID: 2c75820c4bf2e6ed0dab6d922aeac6927b5e2e4dc662dc8188128fe539cf0cf0
Opcode Fuzzy Hash: 02c6954cbcb64e56162da80bdf3b7417e68cd6eb195c9a2433517f3198adb53e
Instruction Fuzzy Hash: FD1182B1704380AEE715EBA69D92B1277E8B745708F14847BF140B66F2C67D9860CB1E

Function 00402838 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040285A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040288D
RegCloseKey.ADVAPI32(?,004028B0,00000000,?,00000004,00000000,004028A9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004028A3

Strings

FPUMaskValue, xrefs: 00402884
SOFTWARE\Borland\Delphi\RTL, xrefs: 00402850

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: ee928b2e9c36cee54b4de11c3a3cd2293e0062a039f5b8df71b0887b07d0b7b2
Instruction ID: a813fbf5fdd61ad2e6297c1d03dc0b5dcb1e266bf9714427259c3b0395662638
Opcode Fuzzy Hash: ee928b2e9c36cee54b4de11c3a3cd2293e0062a039f5b8df71b0887b07d0b7b2
Instruction Fuzzy Hash: 9D018D7A940308B9EB11EF90CD46FEA77ACDB04700F104177B904F65D0E6785A54D79C

Function 00401788 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 0040179E
RtlEnterCriticalSection.KERNEL32(0040A5B4,0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 004017B1
LocalAlloc.KERNEL32(00000000,00000FF8,0040A5B4,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 004017DB
RtlLeaveCriticalSection.KERNEL32(0040A5B4,00401845,00000000,0040183E,?,?,00402022,0040A5F4,00000000,00000000,?,?,00401A11,00401A26,00401B77), ref: 00401838

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: c9b9ab944485395422a6771bfcf5214d8e6e603dede59e4d299fed86385dc31f
Instruction ID: b00ea9f5082304a52c30b3310984ccb38099dd734a88c9f27aa2559637ee1f83
Opcode Fuzzy Hash: c9b9ab944485395422a6771bfcf5214d8e6e603dede59e4d299fed86385dc31f
Instruction Fuzzy Hash: 400184B0604380AEE715AF6A9D06B167BA4E749704F04C53FA140B66F2CA7D44A0CB5F

Function 00406520 Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004064E4: DestroyCursor.USER32(00000000), ref: 004064F3

GetIconInfo.USER32(?), ref: 00406540
GetObjectA.GDI32(?,00000018,?), ref: 00406551
DeleteObject.GDI32(?), ref: 00406566
DeleteObject.GDI32(?), ref: 00406574

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: Object$Delete$CursorDestroyIconInfo
String ID:
API String ID: 3133107492-0
Opcode ID: 57e2f9da13108c725cafe308d1a9a1f75ba6bb4e307d61bf9a431e00cd326d96
Instruction ID: 2ae9454a62f4479f67ab2556911db7116a2ee9a23fb28f719fd143bfb6d196f5
Opcode Fuzzy Hash: 57e2f9da13108c725cafe308d1a9a1f75ba6bb4e307d61bf9a431e00cd326d96
Instruction Fuzzy Hash: B9F06DB1A003117BCB00EE7AAC8594B72DC9F44750B02083EB940FB386E638DD6487E9

Function 00406B48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetIconInfo.USER32(?,?), ref: 00406C00
DeleteObject.GDI32(?), ref: 00406C70

Strings

,k@, xrefs: 00406BD6, 00406C8B

Memory Dump Source

Source File: 0000000A.00000002.2664611600.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_Plat#U0103 revizuit#U0103_shrunk.jbxd

Yara matches

Similarity

API ID: DeleteIconInfoObject
String ID: ,k@
API String ID: 2689914137-1053005162
Opcode ID: 5b49ef8e9806a3f921fc3957ab8aab80d154f68e659bcce45d0d70881c4801f7
Instruction ID: dacdd831d29519e08e7e99a77df17fc26ef5cc856f0b9114ccf97923e4886ce8
Opcode Fuzzy Hash: 5b49ef8e9806a3f921fc3957ab8aab80d154f68e659bcce45d0d70881c4801f7
Instruction Fuzzy Hash: 9F413AB0E0021A9FDB14DF99C881AAEBBB4FF48314F11407AD942B7391D734AE51CB98

Analysis Process: iKHPXKiqI.exePID: 3748, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	97.6%
Signature Coverage:	0%
Total number of Nodes:	125
Total number of Limit Nodes:	4

Executed Functions

Function 02ECB0E8 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02ECB33E

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c1e8116171a74e13a23924c5ab88bb810ea80c9fd0d0f6ff2657db0f0c03429d
Instruction ID: da489405bd3c6426f07b77106cb102446ccbcaa0cba670f3d3d3ce2aba4dff92
Opcode Fuzzy Hash: c1e8116171a74e13a23924c5ab88bb810ea80c9fd0d0f6ff2657db0f0c03429d
Instruction Fuzzy Hash: 03712570A00B058FD724DFAAD55579ABBF1FF88208F108A2DD48AD7B40DB74E946CB91

Function 02EC590C Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EC59C9

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0460507e4aef51344cae607c99fcd1d4b62a081ada5c89c4bb09db830be37a24
Instruction ID: 4685b04ea7222cfb8450876e01d2d05de68a3b5c1817346c0c42c5b042729cfe
Opcode Fuzzy Hash: 0460507e4aef51344cae607c99fcd1d4b62a081ada5c89c4bb09db830be37a24
Instruction Fuzzy Hash: E441D0B0C00719CFDB24CFAAC9857DEBBB5BF48704F6081AAD409AB251DB75694ACF50

Function 054D1284 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054D4381

Memory Dump Source

Source File: 0000000B.00000002.2327478791.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_54d0000_iKHPXKiqI.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1737ebfcd77e3eaf349ba2214de1438db0557b8287a0fcf3ba8ac93ff9120d9b
Instruction ID: 4197ca20cf5dddb1125463b4025d608a5507c57e79ee3e8a0378cdd3c5d1a29d
Opcode Fuzzy Hash: 1737ebfcd77e3eaf349ba2214de1438db0557b8287a0fcf3ba8ac93ff9120d9b
Instruction Fuzzy Hash: CD4108B4A00205CFDB14CF99C458AEEFBF5FB88314F24855AE919AB321D774A841CBA0

Function 02EC4514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02EC59C9

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: faee0dc8fd472ed13f805ca1f588a16cdbf89147a36c13b06865bf09a6edb6e7
Instruction ID: 6de99562ff539e18d76d4af511db182e928d54210c1cb01e09aa26f5ebbcbfeb
Opcode Fuzzy Hash: faee0dc8fd472ed13f805ca1f588a16cdbf89147a36c13b06865bf09a6edb6e7
Instruction Fuzzy Hash: 2F41E470C0071DCBDB14CFAAC9847CEBBB5BF44714F6080AAE408AB251D7756945CF90

Function 02ECAFD4 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ECD58E,?,?,?,?,?), ref: 02ECD64F

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 238b28d6451133456fd5ab6f73454389c33c947a2dfb7fdce84f068c195a6b2e
Instruction ID: a57f1bf85f9838e095853550a644b40eaf6fbbbb80494e4319c9799ab2ea2125
Opcode Fuzzy Hash: 238b28d6451133456fd5ab6f73454389c33c947a2dfb7fdce84f068c195a6b2e
Instruction Fuzzy Hash: 8C21E6B5900209DFDB10CF99D984ADEFFF4EB48314F14841AE918A7350D379A950CFA4

Function 02ECD5C1 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02ECD58E,?,?,?,?,?), ref: 02ECD64F

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8a917359f64f9f8bfa1d10b48591bb22cc3e6c21b6f4cc5dc84c9e3123ab3ea6
Instruction ID: 71e468e3d45873b8e2e62b5fc3fee213f8661aa962e8a8588f96077e04706046
Opcode Fuzzy Hash: 8a917359f64f9f8bfa1d10b48591bb22cc3e6c21b6f4cc5dc84c9e3123ab3ea6
Instruction Fuzzy Hash: DE21E2B5900209DFDB10CFA9D984ADEBBF4FB48314F24841AE958A3350D379A950CFA4

Function 02ECB2D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02ECB33E

Memory Dump Source

Source File: 0000000B.00000002.2321886686.0000000002EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2ec0000_iKHPXKiqI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7cd60491bbb410074c93b49a65d719cf26b3581fe77d529b8bf7ba229739fbef
Instruction ID: 1979b1a435457c699a23c3de5a09120434ea530ff21327c899ae661366b297d1
Opcode Fuzzy Hash: 7cd60491bbb410074c93b49a65d719cf26b3581fe77d529b8bf7ba229739fbef
Instruction Fuzzy Hash: 511113B5C006498FDB10CF9AC544ADFFBF4EB88318F20841ED819A7210C379A545CFA1

Function 071C0BF8 Relevance: .3, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4bf5f8463a71b4e46ecdb219366cb6656b91356f1ed5ed5c713b14abc0fa0d2
Instruction ID: 57eb5a609366b1bfc05120e60e5a90c85114b0caa06cb8710cd6df49e6fe0ea1
Opcode Fuzzy Hash: c4bf5f8463a71b4e46ecdb219366cb6656b91356f1ed5ed5c713b14abc0fa0d2
Instruction Fuzzy Hash: E9A1E6B0E1420ACFDB04DBA8C9906EDBBBAFF5D300F119659D419BB385DB70A846CB50

Function 071C0BE8 Relevance: .3, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5536554ca2a14c881c62aaadb9f6aa3c1bd5a37f48ba304b8ed4d781e29cfeb5
Instruction ID: 532a878ef48a73e55cabb75bf057547b3ac7a5dd41ec75a3038c6dd001cd06c0
Opcode Fuzzy Hash: 5536554ca2a14c881c62aaadb9f6aa3c1bd5a37f48ba304b8ed4d781e29cfeb5
Instruction Fuzzy Hash: D3A1E5B0E1420ACFDB04DFA8C9906EDBBBAFF5D300F119659D519AB385DB70A846CB50

Function 071C5930 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4d181d5cd64a446ce96e9c0ab8d902c04933556313e957a11e4c59a8ec58b6
Instruction ID: 9ae69cf06bc9b110f6230b557c8beb46a8bb6205668ef664ff7b5e6b5ca481f7
Opcode Fuzzy Hash: 8e4d181d5cd64a446ce96e9c0ab8d902c04933556313e957a11e4c59a8ec58b6
Instruction Fuzzy Hash: B861C5B1A00306CFCF16DBB989942ADBBF3AF95650B2805ADC446A73D1DB34ED118B91

Function 071C09D0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0e8354c5dd1cca4be6b58cf43f68605012fafd09d937e39f97407978ea3cb2
Instruction ID: c7defb4a5954048ee485750583df07c320c0b5cce0f01e381a8d685f7b39d3e0
Opcode Fuzzy Hash: fa0e8354c5dd1cca4be6b58cf43f68605012fafd09d937e39f97407978ea3cb2
Instruction Fuzzy Hash: A861B1B4E14219CFDB08CFE9C9846EEFBB6BF9D300F14902AD419AB295DB709945CB50

Function 071C09C3 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee3460d206020002fc24c8ac4719d904c85db12d8b32e1caede64abfdaf1e12b
Instruction ID: a725a8d280cb25c68b9658397a20c8158309bd4ada1ef7475e6d9688d0ed3a43
Opcode Fuzzy Hash: ee3460d206020002fc24c8ac4719d904c85db12d8b32e1caede64abfdaf1e12b
Instruction Fuzzy Hash: 6751E2B4E14208CFDB08CFEAC8846EEFBB6BF99300F14902AD419AB395DB705905CB50

Function 071C5CC8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6eb8df05e4a15fbf0040e273ac07438ae9d77b2c998eb1de9e02bfe170398a
Instruction ID: 49ee7c8d23fcbae246ea73d32df628802a917bcd429fac2e582c1a087859581f
Opcode Fuzzy Hash: 7b6eb8df05e4a15fbf0040e273ac07438ae9d77b2c998eb1de9e02bfe170398a
Instruction Fuzzy Hash: A141D7B1A013568FCB18DFB8C8941BEBBF3AF85200B24846EC455D7384DB34DC528B91

Function 071C4EC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edcd1b269b354179adb8a5eae2250285790c59b8195921bcc2a2a9b7579343be
Instruction ID: 7f85b609d75efe6e2fab938fb281aef7427db410925289198d304c0c8d90f306
Opcode Fuzzy Hash: edcd1b269b354179adb8a5eae2250285790c59b8195921bcc2a2a9b7579343be
Instruction Fuzzy Hash: F431E3B0E082859FDB15DFBCD8206AEBFBABF55220F04816DE8559B3C1DB30895187D1

Function 071C5BA0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 434419d30d13d20754e7384b7085ee329d0df28b6eb9d06c26d765161203d25b
Instruction ID: fd977edfae878e4870e6b609d85a69a7f4620dcdb189edf845b80997c52b5c04
Opcode Fuzzy Hash: 434419d30d13d20754e7384b7085ee329d0df28b6eb9d06c26d765161203d25b
Instruction Fuzzy Hash: 7731A0B4A102089FDB14EBF4E8556EEBBB7FF88210F604129D442B72C4DB315956CB76

Function 071C1A2B Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8af6f1108490a5030f6b9148e1721c2007f7b2bcd870e5868a15cd88183cf7a
Instruction ID: 69720a3dcc8f233041c54e1687e0b39e539b91150b4db636e29b3b9464d2a523
Opcode Fuzzy Hash: a8af6f1108490a5030f6b9148e1721c2007f7b2bcd870e5868a15cd88183cf7a
Instruction Fuzzy Hash: 963118B4918258DFDB65CF54C884BADBBB9BF1A311F0185D9E44EA7292DB30AD84DF00

Function 071C69A7 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33518c23debe981c50b606ae46f93d835cb33affbe27d2d7b02257cd96034371
Instruction ID: 068352cfcb09c87c81947bbc264b4312f0cedba22eaccbd78919068fbe04a839
Opcode Fuzzy Hash: 33518c23debe981c50b606ae46f93d835cb33affbe27d2d7b02257cd96034371
Instruction Fuzzy Hash: F13128B4E15249DFCB05CFA8D455AEDBBF1EF49310F14806AE801AB3A0DB34A945CF91

Function 071C82E9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2dd252e16ae747b2c8cc79fe50c704560ad9958839e3d37b6f06d843144503b
Instruction ID: 8025ee55bc0f385ad9e4ff3126c3522f2aa9128202621d021eb2e84ea13885ed
Opcode Fuzzy Hash: e2dd252e16ae747b2c8cc79fe50c704560ad9958839e3d37b6f06d843144503b
Instruction Fuzzy Hash: 6D2139B0E18259CFCB19DFF9D8945EDBBF5BF9A200F14A02AD405B7290DB305941CB14

Function 0130D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2318202326.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_130d000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cdd35169827c7b25803935fa937eaf5e6b2e3de75c2b22ef7d50c3675a2237
Instruction ID: 677cd1dd2f0d032fcfec59d78506404df373a6c4a5b1a1fbce4b118cfe498582
Opcode Fuzzy Hash: b6cdd35169827c7b25803935fa937eaf5e6b2e3de75c2b22ef7d50c3675a2237
Instruction Fuzzy Hash: 5C21FF72500244EFDB06DF98D990B26BFE5FB8831CF208569ED090B696C336D456CAA2

Function 02CDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2319791525.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2cdd000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221f20b9a33acb89dcd8d620260b6ea4e7620719b167bd7bc166fe3681397544
Instruction ID: 3b1cda2fd7d1a3af9bc23a565eba8761097cd1721212a4c38a791a6401c6682d
Opcode Fuzzy Hash: 221f20b9a33acb89dcd8d620260b6ea4e7620719b167bd7bc166fe3681397544
Instruction Fuzzy Hash: 7621F572904204DFDB14DF14D9C4B16BB65EBC4314F64C56DDA0A4B256C336E447CAA1

Function 02CDD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2319791525.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2cdd000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c7654ef0d280543ed85d7705e84f3f6673ec0a507b2d13c1c1bbc3916d3fcf
Instruction ID: 0655fd5c78e890ea443168c0352ed7dae27b9cb9153ca87f8831023bab6a568a
Opcode Fuzzy Hash: 85c7654ef0d280543ed85d7705e84f3f6673ec0a507b2d13c1c1bbc3916d3fcf
Instruction Fuzzy Hash: EE21D472904204EFDB05DF54D9C0B26BBA5FB88314F24C6ADEA4A4B292C376D846CA61

Function 071C69B8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125899c6f09682c5afc9a5f3f941dbe43d3137aa7ffa71010cd97e1b5abc6c06
Instruction ID: da2a49ecb666785d7d77793a5ec1fbeda0e35a64c3abf744be7ff96e699e4906
Opcode Fuzzy Hash: 125899c6f09682c5afc9a5f3f941dbe43d3137aa7ffa71010cd97e1b5abc6c06
Instruction Fuzzy Hash: 2631A3B4E10209DFCB05DFA9D494AEDBBF5EF49310F14806AE905A73A0DB74A941CF90

Function 071C2374 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d23cfc17da3e76b54127f7459839cd6b67bc1f9a6124af86d9f99fb8e1458d6
Instruction ID: d01d2e07345d82b6d77f0a8ef20f752e8f3ed4de5941e11a1ec7427ff2090920
Opcode Fuzzy Hash: 8d23cfc17da3e76b54127f7459839cd6b67bc1f9a6124af86d9f99fb8e1458d6
Instruction Fuzzy Hash: 4D216FB1E18254DFC709CFAAC8045EEBBFAFF8A201F05C169D849AB256C7309906CF51

Function 071C82F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd29bac5a190e41244c213599dc77f999abefd2bd02e2c9e7d4845d21582eb54
Instruction ID: f98cc16d74629f6387429dc6525757157833f7df3731dabf985821e37ddaed48
Opcode Fuzzy Hash: bd29bac5a190e41244c213599dc77f999abefd2bd02e2c9e7d4845d21582eb54
Instruction Fuzzy Hash: A12105B4E14219CFCB18DFEAD9845EDBBF5AF99300F14A02AD415B3290EB305802CB10

Function 071C8357 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aedb2e213aff886cef7c748d7a003777f4bfddb74de7c53fb0583b194867e72e
Instruction ID: a538b4b1c1120ab4e478c2eef520effc6264bafbb90d853eeaad619c1522609b
Opcode Fuzzy Hash: aedb2e213aff886cef7c748d7a003777f4bfddb74de7c53fb0583b194867e72e
Instruction Fuzzy Hash: 0931B0B8E04208DFDB04DBA4D9649AEBBB2FF89301F208029D9196B795CB345D42CF51

Function 071C7B43 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c2b5c4a6d63b59407c2465c27b2b175802ce4b89ea6e6fa6987e19d3d7ba81
Instruction ID: c268f4458ce14412ec615b20c055da0f3de89f3d1a984b7ec78cad49013cca67
Opcode Fuzzy Hash: a6c2b5c4a6d63b59407c2465c27b2b175802ce4b89ea6e6fa6987e19d3d7ba81
Instruction Fuzzy Hash: 9721C3B582D246CFC706CFB4E8995B8BFB8AB2B211F05625EC046A71D2D7B85944CF01

Function 071C1CA7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1ef13dfce45879363775cb6cc2154fe117e7c8b1ae88ea5dd5fb5893fe95c5
Instruction ID: 7683a4f6bb1866de1215074f76825338c1be87123c927115659b8613694f0501
Opcode Fuzzy Hash: 6a1ef13dfce45879363775cb6cc2154fe117e7c8b1ae88ea5dd5fb5893fe95c5
Instruction Fuzzy Hash: 912107F4958208DFCB19CF90C5909ECB7BABB1E311F119598D40AB7282C731AD85DF20

Function 02CDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2319791525.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2cdd000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64781d67a82c257dc08bb2607e69a8588404a5458f390609d854bc3fa612b83
Instruction ID: c35066331ae5800be554a877ef376f0a0536ca57a9aa6fd8430f2176f76e03e2
Opcode Fuzzy Hash: e64781d67a82c257dc08bb2607e69a8588404a5458f390609d854bc3fa612b83
Instruction Fuzzy Hash: 8C2184755093C08FCB12CF24D594715BF71EB86214F28C5EAD9498F6A7C33AD90ACBA2

Function 071C2398 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94995386d7bd9b9ce3ee1a7a7dc39e7f30a5933dcc826756c7fc8dfdd5c3ed2b
Instruction ID: 0d66954060a5cdc3df3371715da55285775e388e1511850f25fe1e9bf6b8e360
Opcode Fuzzy Hash: 94995386d7bd9b9ce3ee1a7a7dc39e7f30a5933dcc826756c7fc8dfdd5c3ed2b
Instruction Fuzzy Hash: 7C11FEB0E28218DBC709CFAAC8445EDBBFABF9E301F01D129D819A7265DB705901CF50

Function 071C7FC0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4989c152e4dd8f990383e7dcf1eeb525a3ba950de3a2c3de23d9aed7b2955a
Instruction ID: 0e33aeff1bff28a159bbef17b935fec56bfaad5d0efd4e3b506f186b0f4de8d2
Opcode Fuzzy Hash: fb4989c152e4dd8f990383e7dcf1eeb525a3ba950de3a2c3de23d9aed7b2955a
Instruction Fuzzy Hash: 4D1149B5D1425ADFDB04DFE4D5486FEBBF9AB4A201F104429C815B32C0DBB50A55CFA1

Function 0130D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2318202326.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_130d000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 19c0c25f2ee132f61cd14c0b223899b5eb87997413a4b2c9c3fb2ff78af783f6
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 82119D76504284CFCB16CF54D5D4B16BFA1FB88218F2486A9DC490B696C33AD45ACBA1

Function 071C5DE8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be3de183c37a7866a0786a5fdd15f6bb94e9211c22a9413fd596de3de41045d
Instruction ID: 0a422848868d3fab39334a813969f114d41548970d18a289b4d03d6b123bd2ed
Opcode Fuzzy Hash: 5be3de183c37a7866a0786a5fdd15f6bb94e9211c22a9413fd596de3de41045d
Instruction Fuzzy Hash: 171125B4E0025A8FCB44DFB8C8046EEBBF1EF48200F10446AD455A7290DB349A92CB95

Function 02CDD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2319791525.0000000002CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2cdd000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: 943c80789b4e720ff86f26bf45ef8f36efd95335d9199a32e1e12abaf808868d
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 1011DD76904280DFCB01CF10C5C0B15FBB1FB84318F24C6ADD94A4B696C33AD84ACB61

Function 071C8070 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339de1c74ca0fb7cbbedc5bf0212c625d5c157a46e4d713e650b5c12ef928a82
Instruction ID: 7a88499c894c25cfb089546b36d0d14bb41ed99584ded1ca472eec5791c580b4
Opcode Fuzzy Hash: 339de1c74ca0fb7cbbedc5bf0212c625d5c157a46e4d713e650b5c12ef928a82
Instruction Fuzzy Hash: FD113AB4C18289DFDB45CFA5D5852BEBFF4AF0A200F20949AC859E3281E7340A51CB51

Function 071C7ADD Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d916b3ec2f5ae818525f9c9c92ffd7cb87142ced6d1e95a68a952b2940483496
Instruction ID: 1b7fb8392fedaddf3ca2ce059a0c86e8de4ae8735819eb22c299e2d49aef86bc
Opcode Fuzzy Hash: d916b3ec2f5ae818525f9c9c92ffd7cb87142ced6d1e95a68a952b2940483496
Instruction Fuzzy Hash: 0C115EB5C2821ACFCB15DFA4E4496FCBBB4FB2A301F10912AD016632D5CB785A45DF01

Function 071C1930 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabe0acf81396563b24d316ac6d7176f5f9e7c98f81187283369a6fc43ed4206
Instruction ID: 719a12d315422318b35381e59b2b783fdce0e6daff1842cdb88771d0b0888b3e
Opcode Fuzzy Hash: eabe0acf81396563b24d316ac6d7176f5f9e7c98f81187283369a6fc43ed4206
Instruction Fuzzy Hash: 531119B1D046588BEB19CFA7C9057DEBFF7AF89300F14C06AD409BA2A4EB7409468F50

Function 071C1940 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5702d4c2e85895df883af9090239ed6757e89ced31585c8d88800932c32d484d
Instruction ID: f3fc9d025e3720a0e0254cc248c2278a7fb5dba8eaa5b40171fef50d675cdd3e
Opcode Fuzzy Hash: 5702d4c2e85895df883af9090239ed6757e89ced31585c8d88800932c32d484d
Instruction Fuzzy Hash: 8011F2B1D006589BEB18CFABC8447DEFAFBAFC9310F14C06AD409762A4DB7509468F90

Function 071C7FB0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f081690a868bdcef44c8ed159ed9b6aa5e48581f25fd75cf8ac84134fb433b
Instruction ID: b90abc0ddc875eaf0aab3fbdd6aed425b6d267056df471865b8b70eb1a814436
Opcode Fuzzy Hash: b2f081690a868bdcef44c8ed159ed9b6aa5e48581f25fd75cf8ac84134fb433b
Instruction Fuzzy Hash: 5E01F2718192898FDB058BE490483FEBFF8EF0B251F0454AEC450521C2DBB80618CF91

Function 071C2838 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e9ed289e8dc96f6ce96df28097b1a7f589587fadd25399f855f87b323975ee0
Instruction ID: a4f812bd35a974a0d3c0dc870fa8977c51995585ba23ea7855c2e4a14e667ff9
Opcode Fuzzy Hash: 0e9ed289e8dc96f6ce96df28097b1a7f589587fadd25399f855f87b323975ee0
Instruction Fuzzy Hash: 1C015E78A14108EFC704DFA8C646FA8BBF5BB59300F15D098A40897396DB30DE01EB40

Function 071C1F27 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d1d4d939811e5e5e641ed13974d2fd15c924fbeb77f677c179a90f71f4f6c1
Instruction ID: b1f9eb1795e513c2b3c23d91329a3a1b7ac2260d2ba9d73f36eccff52d46d4e6
Opcode Fuzzy Hash: c3d1d4d939811e5e5e641ed13974d2fd15c924fbeb77f677c179a90f71f4f6c1
Instruction Fuzzy Hash: A9114CB0558218DFCB25CF94C5949ECB7BABF1A312F118589E40AAB252C730E880DF14

Function 071C27C0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0ab56da3252957b20d99dcb17c15314b9b2b59cebf269a11e39517d4cd26c7
Instruction ID: 838f186623a893052be5ea7f4e825be1f02ccffd22eb24e855ad40da4f100547
Opcode Fuzzy Hash: 6b0ab56da3252957b20d99dcb17c15314b9b2b59cebf269a11e39517d4cd26c7
Instruction Fuzzy Hash: 2F01D8B191C245DBC708CBA5C5826B8BBFCBB6A301F05D09CD4055B196D7309A05EB50

Function 0130D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2318202326.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_130d000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2d5da9d4222aeab811a4842b7b0fea2b93b79723defbbd0874546ec31febd8
Instruction ID: 211724c3d91e7779824ac8220746aa70de5ca8eb3cf57721dce1a83fbc8f95fc
Opcode Fuzzy Hash: bc2d5da9d4222aeab811a4842b7b0fea2b93b79723defbbd0874546ec31febd8
Instruction Fuzzy Hash: 9A01A7710043849AE7125EE9CD94B67FFDCDF81A28F18851AEE094A6C2D2799441C671

Function 071C2848 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b6a08451c9c6dd6906f197c0be1964bdbc72196d6b16e9f89ced6af1dbaea09
Instruction ID: 55e91773da76f9d21b1cb3b1f3c23ddbbae4b086d0e6391ef4aab46e843bff7f
Opcode Fuzzy Hash: 7b6a08451c9c6dd6906f197c0be1964bdbc72196d6b16e9f89ced6af1dbaea09
Instruction Fuzzy Hash: 3201E874A18108DFDB08DFE9C645EA9BBF9BB59300F15D098A4099B395DB309E01DB40

Function 071C27D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2330b6c07878a1fc9617940815ab9494c99180e565a6f03e00fa8e089f1a30
Instruction ID: 602a912c5f3bc9c522fe173a729d6fd0786171212b85e236adc8361801617cd3
Opcode Fuzzy Hash: 1a2330b6c07878a1fc9617940815ab9494c99180e565a6f03e00fa8e089f1a30
Instruction Fuzzy Hash: 80F031B091C205DFC708CF95D6829B9BBFCBB6A301F11D198D4099B291D7309A41DB50

Function 071C2F10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468b3555f1c5a6f1e9230aa467377e80e103b66ba6d1a50ed61e9dac3e6dc188
Instruction ID: 6ff3bb82ec6a4771322290d7504178eae9bd8baf64d34a521e91aaad590682c0
Opcode Fuzzy Hash: 468b3555f1c5a6f1e9230aa467377e80e103b66ba6d1a50ed61e9dac3e6dc188
Instruction Fuzzy Hash: 2D0148B4D14249AFC750DFA8C4456AEBFF4FB08201F10819AE894A3342D7309A01EFA1

Function 0130D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2318202326.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_130d000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d02a25ed299f8b79cde0d4f0addcac6ee53fd16b79e2a56bf9119a2bc8d5ef5
Instruction ID: 6544ac548dffd59f7b96173bd79c34429cad365f431c21c3def38b09b5d522ae
Opcode Fuzzy Hash: 5d02a25ed299f8b79cde0d4f0addcac6ee53fd16b79e2a56bf9119a2bc8d5ef5
Instruction Fuzzy Hash: 2AF062714053849AE7118E59DCC4B62FFD8EB81638F18C45AED484A286C3799844CAB1

Function 071C3D65 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9af5b39fea731d662eb2aac9c052597d8e9399ebaa6cefe6c2e3f3346ac517c
Instruction ID: 5cce03adb70eac8cc1a4d2105fc7198b67951b85833b508d0cbfa879a991de45
Opcode Fuzzy Hash: f9af5b39fea731d662eb2aac9c052597d8e9399ebaa6cefe6c2e3f3346ac517c
Instruction Fuzzy Hash: 47011AB4A1424ACFDB05DFE8E6546ACBBB6EB55300F108228D811BB7C8D7745D468F40

Function 071C1CED Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a313a707e763ea4180f97bcf2ac7d7800b7f0824125afbee9ed039c445e7e615
Instruction ID: c26c9726e70b2ce527c270faa84c42e9d68188a86a5d976956201e8d883db8ef
Opcode Fuzzy Hash: a313a707e763ea4180f97bcf2ac7d7800b7f0824125afbee9ed039c445e7e615
Instruction Fuzzy Hash: 3AF019F4A5820CDFCB18CF94C1909ECB7BABB5E312F519158E50AA7282C7319D84EB14

Function 071C2F20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0583f86d5480d84ca17972f27e89ff1bcf197aee7659d04e1e2640771cf19c9d
Instruction ID: 7df488ca1830211dafb4540e1cf164a8f2627ab6fe5b6da2a06711e660022fd3
Opcode Fuzzy Hash: 0583f86d5480d84ca17972f27e89ff1bcf197aee7659d04e1e2640771cf19c9d
Instruction Fuzzy Hash: 2D01F6B4D14249AFCB50DFA8D545AAEBBF4FF08301F10C19AE854A7341D7309A40DFA1

Function 071C3D09 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b196752ebcaf545edd44129e6160215ee49fbd67afddf5f64e1034ce088a0c
Instruction ID: c8aee48124a1f1d5868f75d128c241e703b496408d9b9c499bae7ee6b5753049
Opcode Fuzzy Hash: 90b196752ebcaf545edd44129e6160215ee49fbd67afddf5f64e1034ce088a0c
Instruction Fuzzy Hash: 16F024B0D181C9DFD756DBB5C4007A87FBA9B46301F448529D4186A2D5CB344946CB22

Function 071C838F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0d1000911b7fa6d26e5e0d476ef3eade0b38c2095db98761bcec410d9a2320
Instruction ID: 2436a1d2b9e68a15b2d8c84b46fc1c83e9425232465c1e56f1442ed35451a09d
Opcode Fuzzy Hash: 0d0d1000911b7fa6d26e5e0d476ef3eade0b38c2095db98761bcec410d9a2320
Instruction Fuzzy Hash: 6001AFB8E14258DFCB00DFE4D5944ADBBB2FB59351B10902AE81ABB748DB3098028F50

Function 071C87A0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027e8f01581970cff4f40087b3c7cead7f88030eb65d45a36dc3483dfc8d3be2
Instruction ID: 24ed7ee60f0dc81da3c9104901dd0296934e311a2da3811ee3e672a9f2349ffe
Opcode Fuzzy Hash: 027e8f01581970cff4f40087b3c7cead7f88030eb65d45a36dc3483dfc8d3be2
Instruction Fuzzy Hash: ABF0A9B185D3889ACB0ADBF4A0961A87FB88F03106F0480DED848136C3A6301A9AD782

Function 071C3DDF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e040d3606d0a96fb64f36bb2c122191d132e18756f10f584d56cb1efd205847b
Instruction ID: cee2164b72bef9497ba579ac97c885a1d47ba7acac30575f2b1053e6dace491b
Opcode Fuzzy Hash: e040d3606d0a96fb64f36bb2c122191d132e18756f10f584d56cb1efd205847b
Instruction Fuzzy Hash: 5E0169B4E14309DFCB15CFA4E5899ACBBF6FB48301B509129E819AB795CB745842CF40

Function 071C2412 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d070e46380bf2e6ba381a4109db790a53615101af61f3be3340a5801a5a20a83
Instruction ID: ff5d8703f442755bc1bce22212157cd95ffd7aaaff460beffeab52dc2d093c29
Opcode Fuzzy Hash: d070e46380bf2e6ba381a4109db790a53615101af61f3be3340a5801a5a20a83
Instruction Fuzzy Hash: F1F0B7B4D28254CFC749CFA5C5548EDBBBAFF5F201B01D159E859A7262C7349801CF20

Function 071C7CB3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a6419224df405c4edae753750bb16e4103a93ef2cfb8ba3ee4fe31b6e01701
Instruction ID: d048a6e2366d9f0666e6e23f42382c516e0e973a74a353add47bcef91e0b27cf
Opcode Fuzzy Hash: 33a6419224df405c4edae753750bb16e4103a93ef2cfb8ba3ee4fe31b6e01701
Instruction Fuzzy Hash: C7F01DB592921ACFCB25DFA8E4485ACBBB9FB5A305F109229D416A32E1CB785D45CF00

Function 071C428C Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2863eeae48cd967ab1090b548bffa01b0b58ca84b50b8411e7db8c7defb333
Instruction ID: 17d0c33876343e091d496c4694252802f065da49c5fc935ebf40a579bd1a1837
Opcode Fuzzy Hash: 4c2863eeae48cd967ab1090b548bffa01b0b58ca84b50b8411e7db8c7defb333
Instruction Fuzzy Hash: BBF06774A1524ACFCB10DFF8E584A9CBBB9EB59310F208228E811AB3C8C7785C028F00

Function 071C86D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8861df97a3ea517c9738b12dd96eac45f5a6de067e7c39693b3981e2d1388a99
Instruction ID: b1a6d493d71c994c1c592ee8efbf4269ecec667f9419cdd7016d4039e924c1ed
Opcode Fuzzy Hash: 8861df97a3ea517c9738b12dd96eac45f5a6de067e7c39693b3981e2d1388a99
Instruction Fuzzy Hash: FDF0BEB09083C49FC752CBBCC4946987FF0AB0A221F1001E9E8809B2E2E3305965DB12

Function 071C3D18 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dab2034e7e51f128dfe21ef3c4cd7882890633eb5522ba6150dd96bb0e6432a
Instruction ID: aa756c3cdfa491459b30a872fff2b5c4d038a3bdbd114b3094e53a416a8d479a
Opcode Fuzzy Hash: 7dab2034e7e51f128dfe21ef3c4cd7882890633eb5522ba6150dd96bb0e6432a
Instruction Fuzzy Hash: 49F020B0918189CBE756DBE9C4007A87BBE9B46301F80C429C410272D8CF700A86CB22

Function 071C88C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bca2fe08ede5a9c19aa7fdcd76c21a099a9d09b21426b9076125e285eed3de1
Instruction ID: 06bdf25c65939aa1d0f8dccaaf61591d5bf5d0e8d677aa03009080d624b57133
Opcode Fuzzy Hash: 1bca2fe08ede5a9c19aa7fdcd76c21a099a9d09b21426b9076125e285eed3de1
Instruction Fuzzy Hash: F6F0E5708083CAAFC752DBB8D5552A8BFF48F02121F1401EED4C09B6D2E7300906D756

Function 071C81D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62ede10832a17a4ac2b7a2d3364f22ebb334238ff7344404c8c0257ca0abbc9
Instruction ID: 623dc71d421e58753b93df04977941c7a0b362efaeb8df74424dfa87b6f4906e
Opcode Fuzzy Hash: b62ede10832a17a4ac2b7a2d3364f22ebb334238ff7344404c8c0257ca0abbc9
Instruction Fuzzy Hash: D8F0E5719083C59FC762DFB894441DDBFF49F06120F1402DED4849B2D2E7311A45D746

Function 071C8188 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8d9b13396b43fd0988e1924d252e2f6498eed9068f399e7caa35682e56c4399
Instruction ID: ee019fe73e7ca9c661769670e39ef215e8ceeb34ac1cfd915a71a375b4608b52
Opcode Fuzzy Hash: a8d9b13396b43fd0988e1924d252e2f6498eed9068f399e7caa35682e56c4399
Instruction Fuzzy Hash: 20F06579D083889FC712DFA4E4455ACBFB0EF05200F1480DAD4815B7A1D6344F98DF95

Function 071C42F9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1bd5d080934f75a661e978dbf92042ed33e9784de71404617dfb801656fb81
Instruction ID: c09723e0d6feb8f89e5a26a5e9c11049a01fe189f25002852dad19fa9ddca063
Opcode Fuzzy Hash: ce1bd5d080934f75a661e978dbf92042ed33e9784de71404617dfb801656fb81
Instruction Fuzzy Hash: DFF08CF4D04309DBCB11CBA4E8544ACBBB6FB54340B504228D819AB3C0DB745903CF10

Function 071C4ED8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a5da4126cbf584e9d16e85acf67c12ae1429fa2921e06da1ebc44507ed9bab
Instruction ID: 274694bf398f6d1fd72241479173a37478522aef2546f479688e87c36ea3475c
Opcode Fuzzy Hash: 27a5da4126cbf584e9d16e85acf67c12ae1429fa2921e06da1ebc44507ed9bab
Instruction Fuzzy Hash: 3FF01574E1420CEFCB51EFA8D50569DBBF5EF88311F00C0A9A818A7380D6345A51EF41

Function 071C1D50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe70c5e9bbc7c9f5a5564ccaef6718748c1860fe5577dafe177ead0da1852c6
Instruction ID: 412dc735dc2668b6564a6c38bc8e217c607f6a158a7f2c1b57102a38b87707d5
Opcode Fuzzy Hash: dbe70c5e9bbc7c9f5a5564ccaef6718748c1860fe5577dafe177ead0da1852c6
Instruction Fuzzy Hash: 4BF030F056420CDFC719CB90C1908DCB77ABB1E212F518488E00AA7242C731DC80EF14

Function 071C400C Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0bc995133ec2b8b804c1d8322368a1a39fc4f0dba113c5c327c58a5dcfc57a
Instruction ID: 6da2a88ba37ca7498772790a43ff9f62ada72a91bc290a0042863ae8a0309c88
Opcode Fuzzy Hash: 3a0bc995133ec2b8b804c1d8322368a1a39fc4f0dba113c5c327c58a5dcfc57a
Instruction Fuzzy Hash: FEF039B4D68241DFE704DFA8E0598ADBFF4FB15322B05D029E80997361DB304800CF04

Function 071C1B66 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82692d67cbc4b1635836d045e0321ae2ee7abe7518b794315746f6931e22b98
Instruction ID: 847576081e4230a0cbff6f78f5c476a9cfa99db1482de976ca7c21535abae70b
Opcode Fuzzy Hash: b82692d67cbc4b1635836d045e0321ae2ee7abe7518b794315746f6931e22b98
Instruction Fuzzy Hash: 02F074B89052689FDB61CF24C945B98BBB1BB19300F0195DAE549AB341D7709E84CF00

Function 071C87B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81628b6aefa0022a87b07a8acae5452fbd9794b9ad1d3b5b66b45abfdb014d58
Instruction ID: 2b65670db6f62c3651da98b6ba0a2e7b3798a905a0df7442e3b1e2dbd027f9b9
Opcode Fuzzy Hash: 81628b6aefa0022a87b07a8acae5452fbd9794b9ad1d3b5b66b45abfdb014d58
Instruction Fuzzy Hash: 1DD012F1D69248DBCB04DBE4D5865BDBBF89B46201F1091AD8408232C5D7701E95DA45

Function 071C86E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b643c093ebfa86218046dc3715eaeec3a412a5ac9f20384cec956a08584b5e90
Instruction ID: c8cfdb0b75d360e6dec92ba12bdaf69863e3decae9bdcc01a14f63e7461a3c2d
Opcode Fuzzy Hash: b643c093ebfa86218046dc3715eaeec3a412a5ac9f20384cec956a08584b5e90
Instruction Fuzzy Hash: 65E0B6B5A10248DFC780DFA8D58969DBBF4AB08215F2081A9D90897360E7709E54DB41

Function 071C413D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94691e2fc13e43778967b3f512f9df28af54a66e4d4c43f3302c3cf2f16c2199
Instruction ID: 1e7682d0720dd5c63ee09c71f19ca2dc95157385c485198fba4886b9299bd973
Opcode Fuzzy Hash: 94691e2fc13e43778967b3f512f9df28af54a66e4d4c43f3302c3cf2f16c2199
Instruction Fuzzy Hash: ECE0C2B4A04209DFCB25DFA4D6454ACBBB6FB88200B60822DD425A7786D7749952CF61

Function 071C8198 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda65d22fde6ef83eab6e1d6f34344b330876277274010e6c1e0be096d007c7d
Instruction ID: a618f1a45d0ae4cc382e1c633dc201b66782b17c8de3376df3d51bd4b2aa051f
Opcode Fuzzy Hash: eda65d22fde6ef83eab6e1d6f34344b330876277274010e6c1e0be096d007c7d
Instruction Fuzzy Hash: 15E092B4D04248AFCB15DFA9D5456ACBBF4AF49201F1081E9E84467361D6749E44EF81

Function 071C5B60 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19887c01c5ad1933a02e267988787dbcb4c405b9cea7b441edca46fa3840d855
Instruction ID: 9cf8812f645db39081e89973ad74b3e86870cf2e27ea8458017c882048264849
Opcode Fuzzy Hash: 19887c01c5ad1933a02e267988787dbcb4c405b9cea7b441edca46fa3840d855
Instruction Fuzzy Hash: 9FE08C7491420CDFCB01EFE8E40926C7BF9AB44322F1040A8D80467380CA301E41DB82

Function 071C7B8E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7ac53c7b9e632d659f9a5feab21fa1287742e33c981c7cd584e3b1a2e55095
Instruction ID: 27dd82940e23125ad4d1e8c65a82c7e4785ebff126b33243e65ddfd39987f1f3
Opcode Fuzzy Hash: dd7ac53c7b9e632d659f9a5feab21fa1287742e33c981c7cd584e3b1a2e55095
Instruction Fuzzy Hash: C1F04EB4E14228CFDB60DF78D951B99BBB5FB59314F1080EAA80DA7782DB305E819F10

Function 071C7C6A Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac93cd2daf7005068771644de6579eb4d67bc7415c0fd068d7f8b1d14ff3dd62
Instruction ID: 188403174503da3bb0768515812209298b5df790ed2fd02b2744698863ab281a
Opcode Fuzzy Hash: ac93cd2daf7005068771644de6579eb4d67bc7415c0fd068d7f8b1d14ff3dd62
Instruction Fuzzy Hash: 97E0C2B49141588BDB54DF64D440B98BBB1BB59200F10C0AA994AE7380DE300E86AF10

Function 071C81E0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c390d376dac8163200f1ca374e26646dabfdac623ac039ca9f22d8a5ea172f
Instruction ID: 6c10b0bbceb604cef194a21d4109032e45dc85e2e4e197560af0406d77ca63d7
Opcode Fuzzy Hash: 14c390d376dac8163200f1ca374e26646dabfdac623ac039ca9f22d8a5ea172f
Instruction Fuzzy Hash: FFD05EB0D1024CEFCB80EFF8D44579DBBF8AB04201F1081A9C808A7380EB705E80DB81

Function 071C88D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefd95a9bb2dc2f94d5a0723039c504a2ac5546d64e0ce67313cc1c07f5e5a68
Instruction ID: 0bbb4ff86994363d85cb81fe430da59fffb453d0ade9ac39266a8dc7981fbb67
Opcode Fuzzy Hash: eefd95a9bb2dc2f94d5a0723039c504a2ac5546d64e0ce67313cc1c07f5e5a68
Instruction Fuzzy Hash: 07D012B0D10249AFCB40EFE8D54535CBBF49B04201F1040A9880493240E6705E40DB51

Function 071C0635 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b24f2546a1f33ef45ba8d181afd83a1f124138139da832cd1e4eb90adf90773
Instruction ID: d0658c518e93dff762304a3c26dfbb6eee6383142b7606c0bdfbb2ec36e2fe9d
Opcode Fuzzy Hash: 5b24f2546a1f33ef45ba8d181afd83a1f124138139da832cd1e4eb90adf90773
Instruction Fuzzy Hash: 61D05E3094520ACFEB14CB64EC40BD8B779FB88219F0042E5D00CA3200D7305E848F00

Function 071C4090 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87274fc88af6bb3693d808912a3a4c1677d31cb68f4f4c45021168a82c33621
Instruction ID: ecacd00566597a0555e5782a6bd08c27075eaac071652edb87a7ae4df10fa0ae
Opcode Fuzzy Hash: f87274fc88af6bb3693d808912a3a4c1677d31cb68f4f4c45021168a82c33621
Instruction Fuzzy Hash: 8FD0C974A12206CFCB22EF68D1499AC7BBBFB45300B949669D0156F2A8C7745A838F51

Function 071C7D26 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2332518209.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_71c0000_iKHPXKiqI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e052866eb1af80c8bae22d1b8bf51fb454af875aed098933889e5662c3e743
Instruction ID: 252c4dc27772bb6b6844f6dc9db21ea8a02deddd6c4b8bc512dcb03a1509d603
Opcode Fuzzy Hash: c1e052866eb1af80c8bae22d1b8bf51fb454af875aed098933889e5662c3e743
Instruction Fuzzy Hash: 7DB012B001520D87C308C690C2058B833396717602F211408810B631C047600C40CF04

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Plat#U0103 revizuit#U0103_shrunk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\AutoIt3\Uninstall.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Windows Analysis Report
Plat#U0103 revizuit#U0103_shrunk.exe